An OCCRP investigation found a password manager used by European organisations shared software development links with a Russian firm.