Loading npm security reports…

claude-multiacc@2.0.1: AI-agent control-surface risk | LPM Firewall

registry / claude-multiacc / 2.0.1

claude-multiacc@2.0.1

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 6h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install silently changes command resolution for Claude and Codex and persists scheduled package jobs. The shims run the real tools under package-selected credential/config directories.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install -g claude-multiacc

Impact

Unconsented interception and control of subsequent Claude/Codex CLI invocations; daily updates can replace the interceptor.

Mechanism

postinstall PATH shadowing, scheduled persistence, and AI CLI configuration redirection

Policy narrative

On global installation, the postinstall runs install.sh without a separate setup command. It prepends package shims ahead of the genuine Claude and Codex commands, creates recurring launchd or cron jobs, and configures a daily self-update. The shims then select package-managed account directories and export configuration variables before executing the real AI CLIs, creating a persistent foreign control surface over normal agent commands.

Rationale

This is a concrete, unconsented global postinstall mutation of broad Claude and Codex command/configuration control surfaces. The lifecycle guard does not remove the risk for ordinary global installs.

Evidence

scripts/postinstall.mjsinstall.shbin/claudebin/codex$HOME/.zshenv$HOME/.zprofile$HOME/.zshrc$HOME/.bashrc$HOME/Library/LaunchAgents/etc/profile.d/claude-multiacc.sh

Source & flagged code

6 flagged

package.jsonView file

Lines 35-62json

35 ],

36 "author": {

37 "name": "Gowalk"

38 },

39 "license": "MIT",

40 "repository": {

41 "type": "git",

42 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

43 },

44 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

45 "bugs": {

46 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

47 },

48 "publishConfig": {

49 "access": "public"

50 },

51 "engines": {

52 "node": ">=18"

53 },

54 "scripts": {

55 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "test": "bash tests/run-tests.sh && python3 tests/test_selector.py"

57 },

58 "dependencies": {

59 "update-notifier": "^7.3.1"

60 }

61}

62

install.shView file

•path = install.sh kind = build_helper sizeBytes = 21240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 11717 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

tests/run-tests.shView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@1.0.16 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:1.0.16 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tests/run-tests.shView on unpkg

bin/codexView file

Lines 551-591text

551 for a in "$@"; do

552 case "$a" in exec|e) wants_retry=1; break ;; esac

553 done

554 if [ "$wants_retry" = "1" ]; then

555 # A TTY cannot be buffered or replayed: `codex exec` with no prompt argument reads

556 # stdin, and the retry path would hand it /dev/null. Plain exec instead —

557 # stdin is inherited untouched. A pipe that never EOFs would hang the pre-buffer,

558 # so only finite stdin (regular file, /dev/null-style char device) takes the retry

559 # path; everything else execs directly.

560 if [ -t 0 ]; then

561 wants_retry=0

562 elif [ -f /dev/fd/0 ] || [ -c /dev/fd/0 ]; then