That was my first thought too! Looks like it’s actually a command-line tool that scans backups though. It might get access to all your private keys but can’t install malware!