rterm-backend

SUSPICIOUS. The skill is internally coherent for a headless remote-operations backend, so it is not confirmed malicious, but its footprint is very powerful: network-exposed control surfaces, broad secret handling, plugin execution, npm/npx supply-chain paths, and autonomous admin actions. High security risk comes from scope and exposure, not clear deception.

Overall, the code functions as an administrative remote automation client: it connects to a configurable WebSocket gateway, reads existing scheduler settings, and then pushes a new scheduled task whose command is a PowerShell AV signature update (Update-MpSignature). The main security concern is the high-impact remote configuration write that results in later PowerShell execution by the backend/scheduler; misuse depends on gateway trust and server-side authorization. No clear evidence of stealth, obfuscation, or direct data theft is present in this snippet, but the capability to schedule PowerShell remotely warrants careful trust boundary review.

This PowerShell module is an installer/persistence utility rather than an obvious in-file malware payload: it does not contain credential theft or obfuscated logic. However, it introduces meaningful supply-chain and operational risk by performing an unpinned npm global install at runtime and then creating a persistent, aggressively auto-restarting scheduled task that launches the installed backend. It also configures the service to listen on 0.0.0.0:17888, increasing exposure if authentication/TLS is not robust in the backend.

No overt local malware behavior is evident in this file (no exec/eval, no filesystem writes, no direct credential theft or network exfiltration). However, it delegates operational actions to a remote agent via free-form, command-like userInput and determines CI pass/fail solely from remote UI text, creating meaningful supply-chain/trust and integrity risk if the WebSocket endpoint or remote agent is not fully trusted. Additionally, the absolute-path fallback when requiring 'ws' is an unusual environment-specific anomaly that warrants review for packaging correctness and unintended behavior.