Loading npm security reports…

claude-multiacc@2.0.2: Malicious npm security report (Block) | LPM Firewall

registry / claude-multiacc / 2.0.2

claude-multiacc@2.0.2

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Global installation silently installs Claude/Codex interception and persistence. Later account sync sends reusable subscription tokens to a package-selected server.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install -g claude-multiacc, then account setup or sync

Impact

Claude and Codex invocations are intercepted; portable account tokens can be exfiltrated.

Mechanism

postinstall PATH hijack, scheduled persistence, and default SSH token export

Attack narrative

A global npm install automatically runs an installer that modifies shell startup files, shadows both agent CLIs, and creates scheduled jobs. The installed account manager defaults to root@138.197.36.107 without user configuration; its sync routine transfers each portable server.token to that host. This combines unconsented AI-agent control-surface mutation with credential export to a hard-coded third party.

Rationale

The hard-coded remote destination and token transfer are concrete exfiltration behavior, while the global postinstall also hijacks Claude and Codex command resolution. Guarding the hook to global installs does not make those actions consented.

Evidence

scripts/postinstall.mjsinstall.shlib/common.shbin/claude-accountsbin/claudebin/codex$HOME/.zshenv$HOME/.zprofile$HOME/.zshrc$HOME/.bashrc

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 21240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 11717 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

tests/run-tests.shView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.1 matchedPath = tests/run-tests.sh matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tests/run-tests.shView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e7effa9c53071a2c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = claude-multiacc@2.0.1 matchedPath = tests/run-tests.sh matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.1 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

tests/run-tests.shView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@1.0.16 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:1.0.16 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tests/run-tests.shView on unpkg

bin/claudeView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.1 matchedPath = bin/claude matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/claudeView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 35-62json

35 ],

36 "author": {

37 "name": "Gowalk"

38 },

39 "license": "MIT",

40 "repository": {

41 "type": "git",

42 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

43 },

44 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

45 "bugs": {

46 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

47 },

48 "publishConfig": {

49 "access": "public"

50 },

51 "engines": {

52 "node": ">=18"

53 },

54 "scripts": {

55 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "test": "bash tests/run-tests.sh && python3 tests/test_selector.py"

57 },

58 "dependencies": {

59 "update-notifier": "^7.3.1"

60 }

61}

62

install.shView file

•path = install.sh kind = build_helper sizeBytes = 21240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 11717 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

tests/run-tests.shView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.1 matchedPath = tests/run-tests.sh matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tests/run-tests.shView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e7effa9c53071a2c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = claude-multiacc@2.0.1 matchedPath = tests/run-tests.sh matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.1 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

tests/run-tests.shView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@1.0.16 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:1.0.16 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tests/run-tests.shView on unpkg

bin/claudeView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.1 matchedPath = bin/claude matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/claudeView on unpkg