registry / claude-multiacc / 1.0.16

claude-multiacc@1.0.16

Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.33 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 33-60json

33 ],

34 "author": {

35 "name": "Gowalk"

36 },

37 "license": "MIT",

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

41 },

42 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

43 "bugs": {

44 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

45 },

46 "publishConfig": {

47 "access": "public"

48 },

49 "engines": {

50 "node": ">=18"

51 },

52 "scripts": {

53 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "test": "bash tests/run-tests.sh"

55 },

56 "dependencies": {

57 "update-notifier": "^7.3.1"

58 }

59}

install.shView file

•path = install.sh kind = build_helper sizeBytes = 21240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/run-tests.shView file

•path = tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 226057 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/run-tests.shView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@1.0.15 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:1.0.15 similarity = 0.778 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tests/run-tests.shView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code