registry / Credential exfiltration / claude-multiacc / 1.0.10

claude-multiacc@1.0.10

Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The automatic credential transfer to a fixed remote host is a concrete unresolved exposure, so this warrants a warning. The global-install setup also modifies shell PATH and installs scheduled jobs, but the credential transfer is the primary risk.

Static reason

One or more suspicious static signals were detected.

Trigger

A macOS account mutation that invokes auto-sync, unless sync is disabled.

Impact

Account credentials may be exposed to the remote host.

Mechanism

The sync routine uses SSH and rsync to transfer manifest data and present server tokens to the configured host; the default host is fixed in source.

AI rationale

Evidence

bin/claude-accountslib/common.sh

Network endpoints1

138.197.36.107

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Global npm installs automatically run the installer; local installs, CI, Windows, or an opt-out skip it.
On macOS, installation adds the package bin directory to shell startup files and installs scheduled jobs.
The account sync helper runs after account mutations on macOS unless explicitly disabled.
The default sync destination is a fixed remote host.
Sync sends each present server token to that host; the token is a service credential.

Evidence against

The automatic installer is gated to global installs and can be skipped with an environment flag.
Sync is platform-gated to macOS and can be disabled with CLAUDE_MULTIACC_NO_SYNC=1.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.33 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 33-60json

33 ],

34 "author": {

35 "name": "Gowalk"

36 },

37 "license": "MIT",

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

41 },

42 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

43 "bugs": {

44 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

45 },

46 "publishConfig": {

47 "access": "public"

48 },

49 "engines": {

50 "node": ">=18"

51 },

52 "scripts": {

53 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "test": "bash tests/run-tests.sh"

55 },

56 "dependencies": {

57 "update-notifier": "^7.3.1"

58 }

59}

install.shView file

Lines 280-320text

280 manifest_init "${SERVER_OVERRIDE:-$DEFAULT_SERVER}"

281 if [ -n "$SERVER_OVERRIDE" ]; then

282 "$PYBIN" - "$MANIFEST" "$SERVER_OVERRIDE" <<'PYEOF'

283import json, os, sys

284doc = json.load(open(sys.argv[1]))

285doc['server'] = sys.argv[2]

286with open(sys.argv[1] + '.tmp', 'w') as f:

287 json.dump(doc, f, indent=2)

288 f.write('\n')

289os.replace(sys.argv[1] + '.tmp', sys.argv[1])

290PYEOF

291 fi

292 echo " account pool: $ACC_ROOT (manifest ready)"

tests/run-tests.shView file

•path = tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 119124 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/run-tests.shView on unpkg

scripts/postinstall.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// Runs after `npm install`. On a GLOBAL install/update it wires the addon up by

3// running install.sh (idempotent), so `npm i -g claude-multiacc@latest` fully updates

4// the shim, CLI, and scheduled jobs with no extra step. Deliberately best-effort:

5// npm's own CI, sandboxes, and non-global/dev installs must never be broken by it, and

6// a failed install.sh must not fail `npm install` — it only prints how to finish by hand.

7import { spawnSync } from 'node:child_process';

8import { fileURLToPath }

bin/claude-accountsView file

Lines 122-162text

122 if a.get('email', '').lower() == sys.argv[2].lower():

123 print(a['id'])

124 break

125PYEOF

126}

127

128manifest_del_account() { # id

129 "$PYBIN" - "$MANIFEST" "$1" <<'PYEOF'

130import json, sys

131path, aid = sys.argv[1:3]

132doc = json.load(open(path))

133doc['accounts'] = [a for a in doc.get('accounts', []) if a['id'] != aid]

134import os

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 14782 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

300

Findings

2 High7 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirtests/run-tests.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

MediumAi Review Evidencescripts/postinstall.mjs

MediumAi Review Evidenceinstall.sh

MediumAi Review Evidencebin/claude-accounts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to claude-multiacc@1.0.10.

See all versions of claude-multiacc for other recorded verdicts.

Review the evidence and your use of claude-multiacc@1.0.10 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 16:17:37.659Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code