MalwarePublished 17 Jun 2026Updated 8 Jul 2026

boardflow (PyPI) · Malicious Code

Affects boardflowSource GCVE Database

Malicious package : remove boardflow and rotate any secrets on hosts that installed it.

Data as of 9 Jul 2026, 10:03 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-6080

What to do

Remove boardflow from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIboardflow	Affected =1.0.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The boardflow PyPI package versions 1.0.0 and 1.0.1 contain malicious code that executes during installation. The setup.py script spawns a background thread that downloads an executable over unencrypted HTTP from an unrelated domain and runs it with the installer's user privileges. This executable is an infostealer malware that further attempts to download and execute additional malicious scripts. This behavior constitutes an install-time dropper leading to arbitrary remote code execution on the installing system.

Impact

Any user installing boardflow versions 1.0.0 or 1.0.1 risks executing attacker-controlled code with their user privileges. This leads to compromise of the installing system, including potential data theft via the infostealer malware. The malicious code executes silently during installation, making detection difficult. The threat is severe as it allows arbitrary code execution and subsequent malware deployment.

Defensive guidance

Do not install boardflow versions 1.0.0 or 1.0.1 from PyPI. Remove any installations of these versions immediately. Monitor for updates from the PyPI repository or vendor advisory for any remediation or official fixes. Consider using trusted package sources and verifying package integrity before installation.

Summary

The boardflow package on PyPI (versions 1.0.0 and 1.0.1) is a malicious package that overrides the install command in setup.py to spawn a background thread. This thread downloads an executable from http://pooron.org/test.exe via plain HTTP, saving it to the OS temporary directory and executing it using subprocess.Popen with shell=True, suppressing output. The downloaded executable is identified as an infostealer malware that includes a VSCode extension variant which attempts to download and execute a JavaScript script from a hardcoded location. The use of unverified, unsigned, and unpinned remote content over HTTP allows for man-in-the-middle tampering. This results in arbitrary remote code execution on any machine that installs the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 10:03 UTC

Technical details

References

Community reviews