@biklitime/biklimaster@1.1.10

One or more suspicious static signals were detected.

npm postinstall

Unauthorised remote-access persistence and expanded exposure of the host.

privileged hidden-account creation and insecure RDP/firewall configuration

Installing the package automatically runs its install command and seeks administrator elevation. That path enables or creates an administrator-capable account, grants Remote Desktop access, hides the account from the sign-in list, disables Network Level Authentication, allows RDP shadowing without permission, and creates inbound firewall rules for port 3389. A shipped configuration supplies a fallback administrator password. These actions establish remote-access persistence without a separate user command.

Concrete postinstall behavior creates a hidden privileged remote-access path and weakens RDP security. This exceeds a benign installer’s expected scope and is executed automatically on installation.