@biklitime/biklimaster@1.1.11

One or more suspicious static signals were detected.

npm installation on Windows runs postinstall.

Creates an accessible privileged RDP backdoor and weakens remote-session protections.

elevated PowerShell, registry, local-account, and firewall mutation

Installing the package triggers an elevated installer without a separate user command. That installer enables or creates an administrator-capable RDP account, adds it to Administrators and Remote Desktop Users, hides it from the sign-in list, enables RDP, disables NLA, allows permissionless shadowing, and creates inbound firewall rules on port 3389. A preset administrator password is bundled in config.json, making this a concrete remote-access backdoor chain.

The malicious remote-access configuration executes automatically at install time and materially weakens host authentication and visibility. It is not merely an installer primitive or an explicitly invoked setup command.