sbman@1.0.3

One or more suspicious static signals were detected.

npm installation on Windows via postinstall; fallback first CLI invocation can also run installation.

Unauthorised remote access, privileged account persistence, reduced visibility, and weakened host security.

elevated RDP backdoor setup and service masquerading

Installing the package triggers its postinstall installer. On Windows it asks for elevation, executes bundled installers, enables and exposes RDP on 3389 while disabling NLA and permitting shadow access without consent. It enables or creates an administrator-level Remote Desktop account, hides it from the sign-in screen, stores its credentials, and masks the installed Bikli service as a Windows infrastructure service while removing discoverability entries. These are concrete persistence and remote-access actions, not a normal package installation.

The package performs an unconsented elevated postinstall chain that weakens RDP security, creates hidden privileged access, and disguises persistence. No exfiltration endpoint is needed for this concrete backdoor-like behavior.