superacli

{"modified":"2026-05-26T05:55:04Z","published":"2026-05-19T17:19:14Z","schema_version":"1.7.4","id":"MAL-2026-4674","summary":"Malicious code in superacli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6c45fea405a610447f72926e8663afc4151606f39189d380bf929ad09419908b)\nplugins/gopass/daemon.js opens an outbound WebSocket connection to a hardcoded bare IP `ws://92.113.145.178:8768` (defaulted via `process.env.GOPASS_UI_URL || 'ws://92.113.145.178:8768'`) using a hardcoded shared secret `gopass-daemon-shared-secret-2024` as its auth token. After connecting, the daemon registers the local hostname and platform with the remote peer, then accepts inbound 'command' messages and executes them against the user's local gopass password store (show/insert/delete/sync/generate via `spawn('bash',...)`), returning command stdout — including decrypted secrets — to the remote operator. plugins/gopass/.daemon-config ships the same bare-IP URL as a default. Any user who runs the documented `gopass daemon` command on this package hands remote control of their password manager to whoever controls 92.113.145.178, with no per-installer authentication challenge. The destination is not a publisher-owned domain; it is a bare IP. This is a backdoor / silent-relay against the installer's most sensitive local secret store.\n","affected":[{"package":{"ecosystem":"npm","name":"superacli"},"versions":["1.15.0","1.14.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"plugins/gopass/daemon.js","sha256":"56f21de40064631f67d618131f28a9dd5c42df83efd4bce5a5c9bf605a8b7721","tlsh":"f2e19306aefb2d3412b3a06b671b24132613d5036304ee65f6fde7622f4d454a8a37ed"}],"package_integrity":[{"filename":"superacli-1.15.0.tgz","hashes":{"sha1":"a3ac0a825ed5b04d48763a68c3e9b66643a3147c","sha512_sri":"sha512-4s3bjv9R6jvzDFeAOaJjFFtPFHNCbPfF0y5QaDimXhJ96ezGRZfMpDkwNf1woAf4K1l4zLdLhG+bH44wazN5Cw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/superacli/v/1.15.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/superacli/v/1.14.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-003210","import_time":"2026-05-26T05:50:13.161952176Z","modified_time":"2026-05-19T17:20:27Z","sha256":"6c45fea405a610447f72926e8663afc4151606f39189d380bf929ad09419908b","source":"amazon-inspector","versions":["1.15.0"]},{"id":"IN-MAL-2026-003209","import_time":"2026-05-26T05:50:13.050193194Z","modified_time":"2026-05-19T17:19:14Z","sha256":"d7d9550b726186fac26a503604bdd620b6b242326db4f06d04e79b37c7a88438","source":"amazon-inspector","versions":["1.14.0"]}]}}