registry / Persistence / sbirontime
sbirontime
Internal Windows installer for Bikli CLI and Bikli Wrapper
This report shows the evidence for sbirontime@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete malicious install-time behavior: a hidden privileged account, exposed RDP listener, stealth filesystem changes, and Windows-service impersonation. The absence of observed exfiltration endpoints does not reduce the direct backdoor risk.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm installation on Windows runs `install --postinstall`; non-passive CLI use can also trigger first-run setup.
Impact
Unauthorized persistent administrative remote access through port 3389 and reduced user visibility of the installed service/account.
Mechanism
Privileged RDP backdoor provisioning with hidden administrator account and executable impersonation.
Attack narrative
On npm installation, the package runs a postinstall command that elevates through UAC. Its installer deploys bundled executables, creates/starts a service, installs RDP Wrapper, opens inbound TCP and UDP port 3389 rules, enables or creates an administrator-capable RDP user, hides that user from the sign-in screen, and marks folders hidden/system. It also rewrites executable resources to appear as Microsoft svchost.exe. These actions establish a concealed, privileged remote-access foothold without an explicit user command.
AI rationale
This is concrete malicious install-time behavior: a hidden privileged account, exposed RDP listener, stealth filesystem changes, and Windows-service impersonation. The absence of observed exfiltration endpoints does not reduce the direct backdoor risk.
Evidence
package.jsonbin/biklimaster.jslib/bikliwrapper.jspayload/bikli-cli-installer.exepayload/RDPWInst.exeC:\ProgramData\BikliWrapper\admin-credentials.jsonC:\Program Files\BikliC:\Program Files\RDP Wrapper
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Postinstall invokes the privileged installer automatically.
- Installer silently installs payloads, provisions a service, enables RDP, creates an administrator, and hides folders.
- RDP Wrapper creates inbound TCP/UDP firewall rules on port 3389 for every profile.
- Account setup adds an account to Administrators and Remote Desktop Users, then hides it from the Windows sign-in list.
- Executable metadata is rewritten to impersonate Microsoft svchost.exe.
Evidence against
- No HTTP/network-exfiltration endpoint appears in inspected JavaScript.
- Bundled payload checksums are verified before installation, but this does not mitigate the hostile privileged actions.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/biklimaster.js install --postinstall
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/biklimaster.js install --postinstall
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpayload/bikli-cli-installer.exeView file
•path = payload/bikli-cli-installer.exe
kind = native_binary
sizeBytes = 11639800
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
payload/bikli-cli-installer.exeView on unpkgFindings
3 High4 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturebin/biklimaster.js
HighAi Review Evidencebin/biklimaster.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarypayload/bikli-cli-installer.exe
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to sbirontime@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing sbirontime@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.