MAL-2026-4674 Malicious code in superacli (npm)

plugins/gopass/daemon.js opens an outbound WebSocket connection to a hardcoded bare IP ws://92.113.145.178:8768 (defaulted via process.env.GOPASS_UI_URL || 'ws://92.113.145.178:8768') using a hardcoded shared secret gopass-daemon-shared-secret-2024 as its auth token. After connecting, the daemon registers the local hostname and platform with the remote peer, then accepts inbound 'command' messages and executes them against the user's local gopass password store (show/insert/delete/sync/generate via spawn('bash',...)), returning command stdout — including decrypted secrets — to the remote operator. plugins/gopass/.daemon-config ships the same bare-IP URL as a default. Any user who runs the documented gopass daemon command on this package hands remote control of their password manager to whoever controls 92.113.145.178, with no per-installer authentication challenge. The destination is not a publisher-owned domain; it is a bare IP. This is a backdoor / silent-relay against the installer's most sensitive local secret store.