MAL-2026-4674

    Dashboard / Malicious Package / MAL-2026-4674

    MAL-2026-4674

    Published: 19 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in superacli (npm)

    Details: Source: amazon-inspector (6c45fea405a610447f72926e8663afc4151606f39189d380bf929ad09419908b) plugins/gopass/daemon.js opens an outbound WebSocket connection to a hardcoded bare IP `ws://92.113.145.178:8768` (defaulted via `process.env.GOPASS_UI_URL || 'ws://92.113.145.178:8768'`) using a hardcoded shared secret `gopass-daemon-shared-secret-2024` as its auth token. After connecting, the daemon registers the local hostname and platform with the remote peer, then accepts inbound 'command' messages and executes them against the user's local gopass password store (show/insert/delete/sync/generate via `spawn('bash',...)`), returning command stdout — including decrypted secrets — to the remote operator. plugins/gopass/.daemon-config ships the same bare-IP URL as a default. Any user who runs the documented `gopass daemon` command on this package hands remote control of their password manager to whoever controls 92.113.145.178, with no per-installer authentication challenge. The destination is not a publisher-owned domain; it is a bare IP. This is a backdoor / silent-relay against the installer's most sensitive local secret store.

    References: https://www.npmjs.com/package/superacli/v/1.15.0, https://www.npmjs.com/package/superacli/v/1.14.0

    Affected packages

    Package

    Name: superacli

    Purl: pkg:npm/superacli

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.15.0
    MAL-2026-4674 | CVE-DB