Threats Tagged 'mal-2026-13787'

The biklirouter npm package versions 0.5.46 and 0.5.47 include a compiled Next.js application that routes AI/LLM provider CLI commands and manages OAuth flows. While the package uses Node.js built-ins such as child_process and network modules consistent with its declared functionality, a detailed review found no direct evidence of exfiltration of sensitive installer secrets or hardcoded command-and-control destinations. However, a malware advisory states that any system running this package should be considered fully compromised, recommending immediate secret rotation and package removal due to potential full system compromise.