Malicious code in superacli (npm)
The npm package superacli contained malicious code in plugins/gopass/daemon.js that established an unauthorized WebSocket connection to a hardcoded IP address (92.113.145.178:8768), allowing remote operators to execute arbitrary commands against the user's local gopass password store and exfiltrate decrypted secrets.
- Disclosed
- Last updated
- Blast radius
- Any user who installed and ran the superacli package with the gopass daemon command, exposing local password manager access to remote operators.
- Ecosystems
- Attack vectors
- Affected entities
- superaclinpm package containing malicious gopass daemon code
The superacli npm package contained a backdoor in its gopass daemon plugin that connected to a hardcoded bare IP address (92.113.145.178:8768) using a shared secret for authentication. The daemon would register the local hostname and platform with the remote peer upon connection.
Once connected, the daemon accepted inbound 'command' messages and executed them against the user's local gopass password store using bash spawning, supporting operations like show, insert, delete, sync, and generate. Command output—including decrypted secrets—was returned directly to the remote operator.
The malicious IP address was not a publisher-owned domain but a bare IP, indicating this was a silent relay attack against the installer's most sensitive local secret store. Users who ran the documented gopass daemon command would unknowingly hand remote control of their password manager to whoever controlled that IP address, with no per-installer authentication challenge.
The vulnerability was discovered and credited to the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- superacli
- IPs
- 92.113.145.178
Remediation
- Immediately uninstall the superacli package from all systems
- Audit all systems where superacli was installed and the gopass daemon was run for unauthorized access or credential exfiltration
- Rotate all passwords and secrets managed by gopass on affected systems
- Review network logs for outbound WebSocket connections to 92.113.145.178:8768
- Use only verified, trusted password manager packages from reputable sources
- Monitor npm package updates and security advisories for similar malicious packages
Sources
- GitHub Advisory GHSA-7g4m-4fmq-259x · GitHub Advisory Database
Cite this entry
"Malicious code in superacli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-superacli-npm-1l7jta
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in kit-vim-map (npm)
The npm package kit-vim-map contained malicious code that executes a remote-controlled Linux ELF binary on installation, providing the attacker with arbitrary RCE, persistence, and file exfiltration capabilities. The binary beacons to C2 server 217.60.77.63 and establishes persistence via systemd user units.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in newtun (npm)
The newtun npm package contained malicious code that established a reverse shell connection to a hardcoded remote server (pull.7ii.win:7999), granting complete remote code execution and file system access to the attacker. The package exfiltrated system information and credentials while allowing arbitrary command execution and file manipulation.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in bjm-low-code-components (npm)
The npm package bjm-low-code-components contained malicious code in its postinstall hook that exfiltrated installer environment data (hostname, username, working directory, environment variables) to an attacker-controlled OAST endpoint. This reconnaissance beacon was designed to collect information about systems installing the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in sme-rko-finance-front-operations-income (npm)
The npm package sme-rko-finance-front-operations-income contained malicious code that downloads and executes platform-specific native binaries on package import. The package was disguised as a monitoring/observability SDK but contained no legitimate functionality.
npmCompromised packageMalicious commit