registry / Credential exfiltration / claude-multiacc / 1.0.14

claude-multiacc@1.0.14

Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Source inspection confirms that portable account tokens can be sent to a fixed default host after account mutations. The intended mirroring feature is apparent, but the destination's control and authorization are unresolved, so this warrants a warning rather than a confirmed-malware verdict.

Static reason

One or more suspicious static signals were detected.

Trigger

On a Mac, account mutations can trigger automatic synchronization unless sync is disabled or the pool is local-only or a replica.

Impact

Tokens may be exposed to an unverified recipient, enabling use of the associated account capability.

Mechanism

The sync routine uses rsync over SSH to copy each account's server.token to the configured host; the default host is fixed in package source.

AI rationale

Evidence

bin/claude-accountslib/common.sh

Network endpoints1

138.197.36.107

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

lib/common.sh sets a fixed default sync destination at 138.197.36.107.
bin/claude-accounts can sync after account mutations and pushes server.token files to the selected destination.
The inspected code does not establish who controls the default destination or whether users consent to sending tokens there.

Evidence against

The sync code is part of the account-mirroring feature and has local-only and replica guards.
The inspected transfer sends server.token files; it does not send .credentials.json files.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.33 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 33-60json

33 ],

34 "author": {

35 "name": "Gowalk"

36 },

37 "license": "MIT",

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

41 },

42 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

43 "bugs": {

44 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

45 },

46 "publishConfig": {

47 "access": "public"

48 },

49 "engines": {

50 "node": ">=18"

51 },

52 "scripts": {

53 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "test": "bash tests/run-tests.sh"

55 },

56 "dependencies": {

57 "update-notifier": "^7.3.1"

58 }

59}

install.shView file

•path = install.sh kind = build_helper sizeBytes = 20080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/run-tests.shView file

•path = tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 194651 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/run-tests.shView on unpkg

lib/common.shView file

Lines 1-34text

1#!/usr/bin/env bash

2# lib/common.sh — claude-multiacc shared helpers.

3# Sourced by bin/claude-accounts, bin/codex-accounts and install.sh.

4# Bash 3.2 compatible (macOS stock).

6# PROVIDER SUPPORT: the same pool machinery serves two independent providers —

7# claude (Claude Code, the default) and codex (OpenAI Codex CLI). A caller opts

8# into codex by exporting MULTIACC_PROVIDER=codex BEFORE sourcing this file; every

9# path/endpoint global below then points at the codex pool. The two pools are

10# completely separate on disk (~/.claude-accounts vs ~/.codex-accounts), so

11# nothing an operation does on one provider can ever touch the other's accounts.

bin/claude-accountsView file

Lines 160-200text

160 if isinstance(a, dict) and a.get('id') == sys.argv[2]:

161 print(a.get('email', ''))

162 break

163PYEOF

164}

165

166manifest_del_account() { # id

167 "$PYBIN" - "$MANIFEST" "$1" <<'PYEOF'

168import json, sys

169path, aid = sys.argv[1:3]

170doc = json.load(open(path))

171doc['accounts'] = [a for a in doc.get('accounts', []) if a['id'] != aid]

172import os

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 20080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/run-tests.sh

Findings

2 High7 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirtests/run-tests.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

MediumAi Review Evidencelib/common.sh

MediumAi Review Evidencebin/claude-accounts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to claude-multiacc@1.0.14.

See all versions of claude-multiacc for other recorded verdicts.

Review the evidence and your use of claude-multiacc@1.0.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 16:17:14.419Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code