That was my first thought too! Looks like it’s actually a command-line tool that scans backups though. It might get access to all your private keys but can’t install malware!
If you use unencrypted backups they don’t contain your keys, they only get backed up if you encrypt the backup.