registry / @biklitime/biklimaster / 1.1.7

@biklitime/biklimaster@1.1.7

Internal Windows installer for Bikli CLI and Bikli Wrapper

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The postinstall hook elevates and configures a remotely reachable Windows backdoor. It lowers RDP protections, creates or enables a privileged RDP account, and hides it.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Remote access and local administrator persistence on the installing Windows host.

Mechanism

Elevated PowerShell, registry, firewall, and local-account mutation

Attack narrative

Installing the package invokes its postinstall installer. After elevation it installs bundled executables, enables and exposes RDP, disables NLA, enables no-consent shadowing, and creates or enables an administrator-class RDP account hidden from the normal sign-in screen. These actions form an unconsented remote-access persistence chain.

Rationale

The package performs concrete privileged persistence and weakens remote-access controls automatically during npm installation. This is malicious behavior, not a benign installer primitive.

Evidence

package.jsonbin/biklimaster.jslib/bikliwrapper.jsconfig.jsonpayload/bikli-cli-installer.exepayload/RDPWInst.exe%ProgramData%\BikliWrapper\admin-credentials.json

Decision evidence

public snapshot

@biklitime/biklimaster@1.1.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code