biklimaster
One-command Windows installer for Bikli CLI and Bikli Wrapper
This report shows the evidence for biklimaster@1.1.4. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection confirms a concrete privileged remote-access persistence chain activated by postinstall, not merely a risky utility. Documentation does not make automatic hidden-account and weakened-RDP configuration safe.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall (node bin/biklimaster.js install --postinstall)
Impact
An installer can leave a predictable privileged account and remotely reachable RDP service on the host.
Mechanism
elevated silent installer enables hidden privileged RDP access
Attack narrative
The install-time hook requests or uses elevation, installs bundled executables, opens RDP on port 3389, weakens RDP authentication, enables unattended shadowing, and enables or creates an Administrator-level account hidden from the sign-in screen. The package ships a configured password and persists credentials for later retrieval, creating an unconsented remote-access backdoor.
AI rationale
Source inspection confirms a concrete privileged remote-access persistence chain activated by postinstall, not merely a risky utility. Documentation does not make automatic hidden-account and weakened-RDP configuration safe.
Evidence
package.jsonbin/biklimaster.jslib/bikliwrapper.jsconfig.jsonREADME.mdpayload/bikli-cli-installer.exepayload/RDPWInst.exe%ProgramData%\BikliWrapper\admin-credentials.json
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs install automatically in postinstall.
- bin/biklimaster.js silently executes bundled installers with elevation.
- bin/biklimaster.js enables/creates an Administrator-level RDP user and hides it from sign-in.
- lib/bikliwrapper.js opens inbound RDP TCP/UDP 3389 on all firewall profiles.
- lib/bikliwrapper.js disables NLA and enables shadowing without permission.
- config.json contains a package-shipped administrator password used by install.
Evidence against
- README.md describes the RDP/account changes.
- No network client or outbound endpoint appears in inspected JS source.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/biklimaster.js install --postinstall
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/biklimaster.js install --postinstall
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpayload/bikli-cli-installer.exeView file
•path = payload/bikli-cli-installer.exe
kind = native_binary
sizeBytes = 11639800
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
payload/bikli-cli-installer.exeView on unpkgFindings
1 High4 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarypayload/bikli-cli-installer.exe
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to biklimaster@1.1.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing biklimaster@1.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.