registry / @biklitime/biklimaster / 1.1.12

@biklitime/biklimaster@1.1.12

Internal Windows installer for Bikli CLI and Bikli Wrapper

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Installing the package triggers an administrator-elevated Windows installer. It opens and weakens Remote Desktop access, creates or enables a hidden privileged account, and adds RDP firewall rules.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall during package installation; UAC elevation is requested.

Impact

Unauthorized remote access and persistence on the installed Windows host.

Mechanism

privileged RDP backdoor configuration and hidden administrator-account provisioning

Attack narrative

On installation, the postinstall hook runs the installer and requests elevation. The installer configures RDP to listen on 3389, disables Network Level Authentication, enables no-consent shadowing, creates inbound firewall rules, and enables or creates an administrator-level account hidden from the normal sign-in list. These changes establish a durable remote-access path without a separate user command.

Rationale

The install-time hook performs concrete privileged persistence and remote-access weakening, not merely a user-invoked administrative utility. No exfiltration endpoint is needed for this high-impact backdoor behavior.

Evidence

package.jsonbin/biklimaster.jslib/bikliwrapper.jspayload/bikli-cli-installer.exepayload/RDPWInst.exepayload/rdpwrap.iniconfig.json

@biklitime/biklimaster@1.1.12

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code