boardflow@1.1.4

Analysis

boardflow@1.1.4 is a trojanized npm package that misrepresents itself as a kanban board CLI tool. The preinstall script (install.js) is heavily obfuscated with javascript-obfuscator. When run during npm install, it downloads a remote binary from hxxps://www[.]pooron[.]org/ice[.]exe to /tmp/tester_<random_hex>.exe, makes it executable, and spawns it as a detached background process with output suppressed. On Windows it delegates to cmd.exe to launch the binary. After launching the payload it prints a fake "[boardstep] Optional dependencies initialized." message and exits cleanly, hiding the malicious activity from the installer. The downloaded binary (ice.exe) is the actual second-stage payload and its functionality is unknown but runs with the user's privileges.