sbman@1.0.5

One or more suspicious static signals were detected.

npm postinstall: node bin/biklimaster.js install --postinstall

Unauthorized persistent remote administrative access to the Windows host.

Elevated RDP backdoor provisioning with account creation, firewall changes, concealment, and service impersonation

Installation invokes an elevated installer that silently installs and starts a service, enables RDP on port 3389, weakens authentication and shadowing protections, creates or enables an account in Administrators and Remote Desktop Users, hides that account, and stores its credentials locally. The package also hides protected folders and rewrites executable identity fields to present as Microsoft svchost. These actions are automatically triggered by postinstall rather than an explicit user setup command.

This is concrete, unconsented install-time remote-access persistence and concealment behavior. It merits blocking regardless of the absence of observed network exfiltration code.