Loading npm security reports…

claude-multiacc@2.0.21: AI-agent control-surface risk | LPM Firewall

registry / claude-multiacc / 2.0.21

claude-multiacc@2.0.21

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically persists PATH shims for Claude and Codex and installs recurring jobs. Those jobs include an unattended package self-update.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Installing the package globally through npm.

Impact

Future Claude and Codex invocations can be routed through package-controlled shims, and the package can replace itself without a new user action.

Mechanism

Postinstall shell-profile mutation, command shadowing, cron persistence, and automatic npm update.

Policy narrative

On global npm installation, postinstall invokes install.sh without a separate setup command. The installer appends PATH changes to shell startup files, can symlink its Claude and Codex shims into /usr/local/bin, and installs recurring cron jobs. One cron job invokes self-update daily; the update routine checks npm and installs claude-multiacc@latest. This creates persistent interception of AI-agent commands and unattended replacement of the package.

Rationale

This is an unconsented install-time mutation of broad Claude and Codex command control surfaces, combined with persistent scheduled self-updating. The global-install guard does not make these automatic mutations user-invoked setup.

Evidence

package.jsonscripts/postinstall.mjsinstall.shbin/claudebin/claude-accounts$HOME/.zshenv$HOME/.zprofile$HOME/.zshrc$HOME/.bash_profile$HOME/.bashrc

Source & flagged code

7 flagged

package.jsonView file

Lines 34-62json

34 "gowalk"

35 ],

36 "author": {

37 "name": "Gowalk"

38 },

39 "license": "MIT",

40 "repository": {

41 "type": "git",

42 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

43 },

44 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

45 "bugs": {

46 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

47 },

48 "publishConfig": {

49 "access": "public"

50 },

51 "engines": {

52 "node": ">=18"

53 },

54 "scripts": {

55 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "test": "bash tests/run-tests.sh && python3 tests/test_selector.py"

High

Suspicious Lifecycle Evidence

The postinstall hook automatically launches the installer during global npm installs.

package.jsonView on unpkg · L54

57 },

58 "dependencies": {

59 "update-notifier": "^7.3.1"

60 }

61}

62

install.shView file

•path = install.sh kind = build_helper sizeBytes = 22327 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/multiacc-selectView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/multiacc-selectView on unpkg

bin/claudeView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@2.0.19 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.19 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claudeView on unpkg