Loading npm security reports…

claude-multiacc@2.0.17: AI-agent control-surface risk | LPM Firewall

registry / claude-multiacc / 2.0.17

claude-multiacc@2.0.17

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global installation automatically takes control of Claude and Codex command resolution and creates persistent scheduled jobs. Its daily updater can replace the installed package with a future release.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Installing claude-multiacc globally with npm on macOS or Linux.

Impact

The package can intercept later AI CLI use and repeatedly install newer code without another explicit installation command.

Mechanism

Postinstall persistence, PATH shadowing, command replacement, and unattended self-update.

Policy narrative

On global installation, the postinstall hook invokes install.sh without an additional setup command. The installer edits shell startup files to shadow Claude and Codex, may replace their system command paths when privileged, and creates recurring jobs. One scheduled job updates the package to latest automatically, making the command interception persistent and allowing later package releases to run. This is broad, unconsented mutation of AI-agent command control surfaces during npm installation.

Rationale

The package performs automatic postinstall mutation of broad Claude and Codex control surfaces and schedules unattended self-updates. The global-install guard reduces exposure but does not establish consent for these persistent changes.

Evidence

scripts/postinstall.mjsinstall.shbin/codex-accountslib/common.sh$HOME/.zshenv$HOME/.zprofile$HOME/.zshrc$HOME/.bashrc$HOME/Library/LaunchAgents

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

444if [ -z "$INSTANCE" ]; then touch "$HOME/.zshenv" append_block "$HOME/.zshenv" touch "$HOME/.zprofile" append_block "$HOME/.zprofile" touch "$HOME/.zshrc" append_block "$HOME/.zshrc" [ -f "$HOME/.bash_profile" ] && append_block "$HOME/.bash_profile" [ -f "$HOME/.bashrc" ] && append_block "$HOME/.bashrc" echo " PATH block: end of ~/.zshenv, ~/.zprofile, ~/.zshrc (+ bash rc files if present)"

High

Ai Review Evidence

The installer rewrites shell startup files to put its Claude and Codex shims first on PATH.

install.shView on unpkg · L444

•path = install.sh kind = build_helper sizeBytes = 22327 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 17190 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claudeView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@2.0.9 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.9 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claudeView on unpkg

scripts/postinstall.mjsView file

20if (process.env.CLAUDE_MULTIACC_SKIP_POSTINSTALL === '1') skip('CLAUDE_MULTIACC_SKIP_POSTINSTALL=1'); if (process.env.CI) skip('CI environment'); const isGlobal = process.env.npm[redacted] === 'true' || process.env.npm[redacted] === '1'; if (!isGlobal) skip('local/dev install — not global'); if (process.platform === 'win32') skip('Windows is not supported by the shim'); console.log('claude-multiacc: configuring the PATH shim + scheduled jobs (install.sh)…'); const r = spawnSync('bash', [join(ROOT, 'install.sh')], { stdio: 'inherit' });

High

Suspicious Lifecycle Evidence

Global npm installation automatically runs an installer through postinstall.

scripts/postinstall.mjsView on unpkg · L20

Source & flagged code

7 flagged

package.jsonView file

Lines 35-62json

35 ],

36 "author": {

37 "name": "Gowalk"

38 },

39 "license": "MIT",

40 "repository": {

41 "type": "git",

42 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

43 },

44 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

45 "bugs": {

46 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

47 },

48 "publishConfig": {

49 "access": "public"

50 },

51 "engines": {

52 "node": ">=18"

53 },

54 "scripts": {

55 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "test": "bash tests/run-tests.sh && python3 tests/test_selector.py"

57 },

58 "dependencies": {

59 "update-notifier": "^7.3.1"

60 }

61}

62

install.shView file

Lines 424-464text

424 if ! "$REPO_DIR/bin/codex-accounts" init-pool "${SERVER_OVERRIDE:-}" >/dev/null 2>&1; then

425 echo " WARNING: codex pool init failed (codex-accounts init-pool)" >&2

426 else

427 echo " codex account pool: $CODEX_ACC_ROOT (manifest ready)"

428 fi

429

430 # An INSTANCE install never rewrites the shell rc blocks: one interactive PATH

431 # cannot serve two pools, and clobbering the default install's block would point

432 # the operator's shell at an instance pool. Its agents (below) carry the roots

433 # instead, and the runner daemon invokes the shims by absolute path.

434 if [ -n "$INSTANCE" ]; then

435

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 17190 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claudeView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@2.0.9 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.9 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claudeView on unpkg

scripts/postinstall.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// Runs after `npm install`. On a GLOBAL install/update it wires the addon up by

3// running install.sh (idempotent), so `npm i -g claude-multiacc@latest` fully updates

4// the shim, CLI, and scheduled jobs with no extra step. Deliberately best-effort:

5// npm's own CI, sandboxes, and non-global/dev installs must never be broken by it, and

6// a failed install.sh must not fail `npm install` — it only prints how to finish by hand.

7import { spawnSync } from 'node:child_process';

8import { fileURLToPath }