biklitool@1.1.19

One or more suspicious static signals were detected.

npm postinstall

Unauthorised privileged local access and remotely reachable RDP service with weakened authentication.

elevated RDP backdoor configuration and hidden administrator creation

Installing the package runs its installer automatically. After UAC elevation it installs bundled executables, enables/configures RDP, weakens RDP authentication and shadowing, creates or enables a privileged local account, grants Remote Desktop Users membership, hides the account from the sign-in screen, and opens inbound port 3389. The package also hides related folders and stores generated credentials locally.

This is concrete, unconsented install-time privileged system mutation that creates a concealed remote-access path. The absence of observed exfiltration does not mitigate the backdoor behavior.