boardflownpm

[email protected] declares a preinstall lifecycle hook (node install.js) that runs automatically on npm install. install.js is heavily obfuscated with obfuscator.io-style string-array indirection (hex-named identifiers, arithmetic-encoded indices, shuffled string table) hiding the destination URL, output filename, and spawn options. After deobfuscation, it downloads https://www.pooron.org/ice.exe to the OS temp directory under a random name (tester_<hex>.exe), chmods the file to 755, and spawns it detached with stdio=ignore on win32, darwin, and Linux — running an opaque, unverified Windows PE binary on every installer's machine with no hash or signature check. The package.json description (a kanban board library) is a cover story; the package ships no library code matching that purpose. The package also declares a dependency on boardwalk@^1.1.4 (same actor as the author field), pulling another likely-malicious package into the install closure. pooron.org is a non-publisher, non-registry domain unrelated to the advertised purpose, and the obfuscation of the URL and exec path is the canonical malicious-dropper fingerprint.