The boardflow PyPI package versions 1.0.0 and 1.0.1 contain malicious code that executes during installation. The setup.py script spawns a background thread that downloads an executable over unencrypted HTTP from an unrelated domain and runs it with the installer's user privileges. This executable is an infostealer malware that further attempts to download and execute additional malicious scripts. This behavior constitutes an install-time dropper leading to arbitrary remote code execution on the installing system.