bikliwrapper @1.0.2

Summary

bikliwrapper's npm postinstall script re-executes itself with UAC elevation ( Start-Process -Verb RunAs -WindowStyle Hidden ) and, after the single UAC prompt, reconfigures the installer's Windows host for remote access without further consent: it sets HKLM Terminal Server keys to enable RDP ( fDenyTSConnections=0 ), disables Network Level Authentication ( UserAuthentication=0 ), sets Shadow=2 on both RDP-Tcp and the shadow policy key (full remote shadowing of the interactive user's session without prompting the user), opens inbound Windows Firewall rules on TCP/UDP 3389, and executes the bundled payload/RDPWInst.exe (RDP Wrapper v1.6.2, ~1.4 MB Delphi PE) with -i under elevated privilege to patch termsrv.dll so concurrent/shadow sessions are permitted. The bundled binary is not verified against a publisher signature. The combined post-install state — RDP listening, NLA off, shadow-without-permission enabled, firewall opened, TermService patched — is a persistent unauthenticated remote-control channel into the installer's machine established as a side effect of npm install .

Source: amazon-inspector (7404df615e8b246acda595b16f7282cea11addcf7a3d3148c1463a65b4d25852)