biklimaster@1.1.4

Summary

The npm postinstall hook (node bin/biklimaster.js install --postinstall) prompts for UAC elevation and then reconfigures the installer's Windows host into a remotely reachable, attacker-accessible machine. createRdpAdministrator either enables the built-in Administrator (RID 500) or creates a local admin account via PowerShell New-LocalUser, sets its password to the value shipped in config.json (administratorPassword: "Hacker@1290"), adds it to Administrators and Remote Desktop Users, and hides it from the Windows sign-in user list by writing to SpecialAccounts\UserList. bikliwrapper.js then applies registry settings enabling Remote Desktop (fDenyTSConnections=0), pinning PortNumber=3389, disabling Network Level Authentication (UserAuthentication=0), and enabling non-consensual session shadowing (Shadow=2), and adds inbound firewall Allow rules for TCP/UDP 3389 (BikliWrapper-RDP-TCP/UDP). The postinstall also silently executes bundled unsigned Windows binaries (bikli-cli-installer.exe /S, RDPWInst.exe -i, which patches termsrv.dll via RDP Wrapper). Because the credential is shipped in a package published publicly on npm, every installer receives the same admin password — the README even acknowledges it is 'visible to everyone if the package is published publicly' and that the bundled Windows executables are unsigned. The net effect of npm install -g biklimaster on Windows is a hidden local administrator account with a known password on an externally reachable RDP endpoint with NLA off and shadow-without-consent on.

Source: amazon-inspector (16fe526cf29535e21a0d1c3206405e20d0447ca01f25ea46dc9569ab52066555)