sbironman@4.0.0

One or more suspicious static signals were detected.

npm postinstall on Windows

Unauthorized privileged remote access, reduced RDP protections, stealthy persistence, and host exposure.

elevated silent RDP backdoor setup with account creation, concealment, and persistence

Installing the package triggers an elevated installer without a separate user command. It silently installs bundled binaries, enables and exposes RDP, configures an administrator or creates a local administrator account, adds it to remote-access groups, and hides the account. It then disguises the Bikli executable and service as Microsoft/svchost, removes identifiable history, and keeps Terminal Services enabled across reboots.

This is concrete unconsented postinstall host compromise behavior, not a package-aligned setup action. No network exfiltration is needed for the package to establish stealthy privileged remote access.