The boardflow package on PyPI (versions 1.0.0 and 1.0.1) is a malicious package that overrides the install command in setup.py to spawn a background thread. This thread downloads an executable from http://pooron.org/test.exe via plain HTTP, saving it to the OS temporary directory and executing it using subprocess.Popen with shell=True, suppressing output. The downloaded executable is identified as an infostealer malware that includes a VSCode extension variant which attempts to download and execute a JavaScript script from a hardcoded location. The use of unverified, unsigned, and unpinned remote content over HTTP allows for man-in-the-middle tampering. This results in arbitrary remote code execution on any machine that installs the package.

Any user installing boardflow versions 1.0.0 or 1.0.1 risks executing attacker-controlled code with their user privileges. This leads to compromise of the installing system, including potential data theft via the infostealer malware. The malicious code executes silently during installation, making detection difficult. The threat is severe as it allows arbitrary code execution and subsequent malware deployment.

Do not install boardflow versions 1.0.0 or 1.0.1 from PyPI. Remove any installations of these versions immediately. Since no official patch or fixed version is indicated, avoid using this package entirely. Monitor for updates from the PyPI repository or vendor advisory for any remediation or official fixes. Consider using trusted package sources and verifying package integrity before installation.