biklitool@1.1.20

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

npm postinstall; no separate user command is required.

Unauthenticated installation can create privileged remote access and evade normal user visibility.

Elevated silent RDP backdoor provisioning and service masquerading.

Installing the package triggers an elevated installer. It executes bundled Windows installers, enables RDP on port 3389 with broad inbound firewall rules, disables Network Level Authentication, permits shadowing without consent, and provisions an enabled administrator-level Remote Desktop account. It then hides folders and alters executable/service presentation to resemble a Windows Service Host, creating a concrete stealthy remote-access persistence chain.

The package performs concrete privileged, stealthy remote-access provisioning automatically at postinstall. The absence of web exfiltration does not mitigate this local backdoor behavior.