biklitool@1.1.11

Analysis

The package's postinstall hook enables Remote Desktop on port 3389, opens inbound firewall rules, disables Network Level Authentication, and enables full RDP shadowing without permission. It then creates a hidden local administrator account (the built-in Administrator, or a new 'admin'/'user' account) using a hardcoded administrator password shipped in the package's config.json, and hides the account from the Windows sign-in screen. The configured credentials are also written to %ProgramData%\BikliWrapper\admin-credentials.json. Installing the package leaves the machine with a hidden admin account whose password is publicly known and Remote Desktop exposed with authentication weakened, providing persistent remote access with known credentials.