Loading npm security reports…

claude-multiacc@1.0.11: AI-agent control-surface risk | LPM Firewall

registry / claude-multiacc / 1.0.11

claude-multiacc@1.0.11

Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically shadows Claude/Codex commands and creates persistent scheduled jobs. The package also embeds a remote SSH target for token sync.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install -g claude-multiacc

Impact

Subsequent Claude/Codex invocations are redirected through package shims; scheduled code runs repeatedly and portable tokens can be sent to the embedded remote server.

Mechanism

postinstall PATH hijacking, scheduled persistence, and token synchronization

Policy narrative

On global installation, postinstall invokes install.sh without an explicit setup command. The installer modifies shell startup files so its Claude and Codex shims take precedence, then installs recurring launchd or cron jobs including a daily self-update. It seeds a fixed SSH server and the sync implementation uploads portable server tokens there. This is unconsented install-time mutation of broad AI-agent command and scheduling control surfaces.

Rationale

The lifecycle hook performs broad, persistent Claude/Codex interception and scheduled execution on global install. Under the firewall policy, this concrete unconsented postinstall control-surface mutation warrants blocking despite package-described functionality.

Evidence

scripts/postinstall.mjsinstall.shlib/common.shbin/claude-accountsbin/claudebin/codex$HOME/.zshenv$HOME/.zprofile$HOME/.zshrc$HOME/.bashrc/etc/profile.d/claude-multiacc.sh

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

305touch "$HOME/.zshenv" append_block "$HOME/.zshenv" touch "$HOME/.zprofile" append_block "$HOME/.zprofile" touch "$HOME/.zshrc" append_block "$HOME/.zshrc" [ -f "$HOME/.bash_profile" ] && append_block "$HOME/.bash_profile" [ -f "$HOME/.bashrc" ] && append_block "$HOME/.bashrc" echo " PATH block: end of ~/.zshenv, ~/.zprofile, ~/.zshrc (+ bash rc files if present)" [ "$NO_SCHEDULE" = "1" ] || mac_schedule_install

High

Ai Review Evidence

Installer prepends package shims ahead of Claude and Codex.

install.shView on unpkg · L305

191{ crontab -l 2>/dev/null | grep -v "$CRON_TAG" || true; } > "$tmp" { echo "* * * * * $REPO_DIR/bin/claude-accounts limits --quiet >/dev/null 2>&1 $CRON_TAG" echo "* * * * * $REPO_DIR/bin/codex-accounts limits --quiet >/dev/null 2>&1 $CRON_TAG" echo "17 9 * * 1 $REPO_DIR/bin/claude-accounts health >/dev/null 2>&1 $CRON_TAG" echo "37 9 * * 1 $REPO_DIR/bin/codex-accounts health >/dev/null 2>&1 $CRON_TAG" [ "${CLAUDE_MULTIACC_AUTOUPDATE:-1}" = "1" ] && \ echo "7 4 * * * $REPO_DIR/bin/claude-accounts self-update --quiet >/dev/null 2>&1 $CRON_TAG" } >> "$tmp" cronta

High

Ai Review Evidence

Installer persists minute-level launchd/cron jobs and daily updates.

install.shView on unpkg · L191

•path = install.sh kind = build_helper sizeBytes = 14782 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/run-tests.shView file

•path = tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 127196 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/run-tests.shView on unpkg

scripts/postinstall.mjsView file

22const isGlobal = process.env.npm[redacted] === 'true' || process.env.npm[redacted] === '1'; if (!isGlobal) skip('local/dev install — not global'); if (process.platform === 'win32') skip('Windows is not supported by the shim'); console.log('claude-multiacc: configuring the PATH shim + scheduled jobs (install.sh)…'); const r = spawnSync('bash', [join(ROOT, 'install.sh')], { stdio: 'inherit' });

High

Suspicious Lifecycle Evidence

Global postinstall runs install.sh automatically.

scripts/postinstall.mjsView on unpkg · L22

Source & flagged code

7 flagged

package.jsonView file

Lines 33-60json

33 ],

34 "author": {

35 "name": "Gowalk"

36 },

37 "license": "MIT",

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

41 },

42 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

43 "bugs": {

44 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

45 },

46 "publishConfig": {

47 "access": "public"

48 },

49 "engines": {

50 "node": ">=18"

51 },

52 "scripts": {

53 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "test": "bash tests/run-tests.sh"

55 },

56 "dependencies": {

57 "update-notifier": "^7.3.1"

58 }

59}

60

install.shView file

Lines 171-211text

171 launchctl load -w "$PLIST_LIMITS" 2>/dev/null || echo " (launchctl load limits agent failed — limits refresh will rely on the shim's opportunistic kick)"

172 launchctl load -w "$PLIST_HEALTH" 2>/dev/null || true

173 launchctl load -w "$PLIST_CODEX_LIMITS" 2>/dev/null || true

174 launchctl load -w "$PLIST_CODEX_HEALTH" 2>/dev/null || true

175 [ "${CLAUDE_MULTIACC_AUTOUPDATE:-1}" = "1" ] && launchctl load -w "$PLIST_UPDATE" 2>/dev/null || true

176 echo " launchd: limits refresh every 60s (claude + codex) + weekly health checks + daily auto-update"

177}

178

179mac_schedule_remove() {

180 launchctl unload "$PLIST_LIMITS" 2>/dev/null || true

181 launchctl unload "$PLIST_HEALTH" 2>/dev/null || true

tests/run-tests.shView file

•path = tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 127196 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/run-tests.shView on unpkg

scripts/postinstall.mjsView file

Lines 2-33javascript

2// Runs after `npm install`. On a GLOBAL install/update it wires the addon up by

3// running install.sh (idempotent), so `npm i -g claude-multiacc@latest` fully updates

4// the shim, CLI, and scheduled jobs with no extra step. Deliberately best-effort:

5// npm's own CI, sandboxes, and non-global/dev installs must never be broken by it, and

6// a failed install.sh must not fail `npm install` — it only prints how to finish by hand.

7import { spawnSync } from 'node:child_process';

8import { fileURLToPath } from