The bikliwrapper npm package's postinstall script executes itself with elevated privileges, prompting the user once for UAC. It then modifies Windows Registry keys under HKLM to enable Remote Desktop Protocol (RDP) connections by setting fDenyTSConnections=0, disables Network Level Authentication (UserAuthentication=0), and enables full remote shadowing (Shadow=2) without user consent. It opens inbound firewall rules on TCP/UDP port 3389 and runs an unsigned bundled executable (RDP Wrapper v1.6.2) with elevated privileges to patch termsrv.dll, allowing concurrent and shadow sessions. This results in a persistent, unauthenticated remote control channel established as a side effect of installing the package via npm.

The impact is a complete compromise of the affected Windows machine. The attacker gains persistent, unauthenticated remote access with full control, including the ability to shadow user sessions without consent. All secrets and keys stored on the compromised machine are at risk and should be considered exposed. Removal of the package alone does not guarantee elimination of the malicious backdoor or any additional malware installed.

Immediate removal of the bikliwrapper package is recommended. However, due to the persistent nature of the backdoor, the affected system should be considered fully compromised. All credentials and secrets stored on the machine must be rotated from a separate, trusted device. A full system rebuild or forensic analysis is advised to ensure complete eradication of the threat. No official patch or fix is available; remediation requires manual removal and incident response.