sbman@1.0.4

One or more suspicious static signals were detected.

npm postinstall; also first non-passive CLI invocation when setup is incomplete.

Unconsented host modification creates concealed administrative remote access.

elevated covert remote-access and persistence setup

On npm postinstall, the package elevates itself and silently installs bundled native payloads. It enables RDP and inbound firewall rules, provisions an Administrator/Remote Desktop Users account, stores credentials, hides the account from the sign-in screen, and disguises its service as Windows infrastructure. These changes occur without an explicit user command and establish concealed remote-access capability.

This is concrete malicious install-time behavior: it modifies Windows security controls and creates concealed privileged remote access. Lack of observed exfiltration does not mitigate the unconsented persistence and access setup.