biklimaster @1.1.4

Summary

The npm postinstall hook ( node bin/biklimaster.js install --postinstall ) prompts for UAC elevation and then reconfigures the installer's Windows host into a remotely reachable, attacker-accessible machine. createRdpAdministrator either enables the built-in Administrator (RID 500) or creates a local admin account via PowerShell New-LocalUser , sets its password to the value shipped in config.json ( administratorPassword: "Hacker@1290" ), adds it to Administrators and Remote Desktop Users, and hides it from the Windows sign-in user list by writing to SpecialAccounts\UserList . bikliwrapper.js then applies registry settings enabling Remote Desktop ( fDenyTSConnections=0 ), pinning PortNumber=3389 , disabling Network Level Authentication ( UserAuthentication=0 ), and enabling non-consensual session shadowing ( Shadow=2 ), and adds inbound firewall Allow rules for TCP/UDP 3389 ( BikliWrapper-RDP-TCP/UDP ). The postinstall also silently executes bundled unsigned Windows binaries ( bikli-cli-installer.exe /S , RDPWInst.exe -i , which patches termsrv.dll via RDP Wrapper). Because the credential is shipped in a package published publicly on npm, every installer receives the same admin password — the README even acknowledges it is 'visible to everyone if the package is published publicly' and that the bundled Windows executables are unsigned. The net effect of npm install -g biklimaster on Windows is a hidden local administrator account with a known password on an externally reachable RDP endpoint with NLA off and shadow-without-consent on.

Source: amazon-inspector (16fe526cf29535e21a0d1c3206405e20d0447ca01f25ea46dc9569ab52066555)