sbironman@1.0.0

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

npm postinstall for sbironman@1.0.0 on Windows

Unauthorized persistent remote access and reduced visibility on the host.

elevated install-time RDP backdoor setup with stealth service masquerading

Installing the package triggers its postinstall command. The installer requests elevation, executes bundled Windows payloads, enables RDP with weakened authentication and unattended shadowing, opens port 3389, and creates or enables an administrator-capable account. It then hides the account and related folders and modifies executable/service metadata to resemble Microsoft svchost infrastructure. These actions form a concrete stealthy remote-access persistence chain.

Source directly confirms unconsented install-time creation of a concealed, privileged RDP access path and service masquerading. Absence of JavaScript network exfiltration does not mitigate this concrete local compromise chain.