@biklitime/biklimaster@1.1.6

Analysis

On install, this Windows-only package silently enables Remote Desktop on port 3389, installs the third-party RDP Wrapper tool to patch termsrv.dll, and creates or enables a hidden local administrator account (the built-in Administrator, or a new 'admin'/'user' account) using a hardcoded password shipped in the package's config.json. The account is added to the Administrators and Remote Desktop Users groups, hidden from the Windows sign-in screen, and its credentials are written to %ProgramData%\BikliWrapper\admin-credentials.json. Network Level Authentication is disabled and firewall rules are opened for port 3389. The result is persistent remote RDP access to the machine with a known password.