claude-multiacc@2.0.18

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.67 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 35-62json

35 ],

36 "author": {

37 "name": "Gowalk"

38 },

39 "license": "MIT",

40 "repository": {

41 "type": "git",

42 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

43 },

44 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

45 "bugs": {

46 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

47 },

48 "publishConfig": {

49 "access": "public"

50 },

51 "engines": {

52 "node": ">=18"

53 },

54 "scripts": {

55 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "test": "bash tests/run-tests.sh && python3 tests/test_selector.py"

57 },

58 "dependencies": {

59 "update-notifier": "^7.3.1"

60 }

61}

install.shView file

•path = install.sh kind = build_helper sizeBytes = 22327 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 17190 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claudeView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.17 matchedPath = bin/claude matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/claudeView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@2.0.9 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.9 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claudeView on unpkg

bin/cli.mjsView file

•matchType = malicious_source_fingerprint_signature signature = a22bffb762c5089d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = claude-multiacc@2.0.17 matchedPath = bin/cli.mjs matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.17 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.mjsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 22327 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.py

Findings

5 High4 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirtests/test_selector.py

HighKnown Malware Source Similaritybin/claude

HighKnown Malware Source Fingerprint Signaturebin/cli.mjs

HighPrevious Version Dangerous Deltabin/claude

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to claude-multiacc@2.0.18.

See all versions of claude-multiacc for other recorded verdicts.

Review the evidence and your use of claude-multiacc@2.0.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-29 15:24:24.642Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.