Loading npm security reports…

claude-multiacc@2.0.23: Malicious npm security report (Block) | LPM Firewall

registry / claude-multiacc / 2.0.23

claude-multiacc@2.0.23

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

A global npm installation automatically modifies command resolution for the separate Claude Code and Codex CLIs and establishes scheduled execution. It also schedules automatic package replacement from npm.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install -g claude-multiacc

Impact

Subsequent claude and codex invocations can be routed through package-controlled shims, while scheduled jobs retain execution and update the package without a separate user command.

Mechanism

Postinstall-driven PATH interception, scheduler persistence, and automatic self-update.

Attack narrative

On global npm installation, the lifecycle hook invokes install.sh without requiring a separate setup command. The installer adds its directory ahead of normal PATH locations, so claude and codex resolve to package shims; root installs also create matching system-wide symlinks. It then creates recurring launchd or cron jobs and enables a daily self-update that installs the latest npm release. This is unconsented lifecycle mutation of broad, third-party AI-agent command surfaces and creates persistent package-controlled execution.

AI rationale

The package combines an automatic global postinstall hook with broad PATH and command interception for Claude Code and Codex, recurring scheduled execution, and automatic remote package updates. This is concrete install-hook abuse of foreign AI-agent control surfaces.

Evidence

package.jsonscripts/postinstall.mjsinstall.shlib/common.sh$HOME/.zshenv$HOME/.zprofile

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 22327 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/multiacc-selectView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/multiacc-selectView on unpkg

bin/claudeView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.22 matchedPath = bin/claude matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.22 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/claudeView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@2.0.19 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.19 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claudeView on unpkg

bin/cli.mjsView file

•matchType = malicious_source_fingerprint_signature signature = d80f1af7d3d7e108 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = claude-multiacc@2.0.22 matchedPath = bin/cli.mjs matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.22 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 35-62json

35 ],

36 "author": {

37 "name": "Gowalk"

38 },

39 "license": "MIT",

40 "repository": {

41 "type": "git",

42 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

43 },

44 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

45 "bugs": {

46 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

47 },

48 "publishConfig": {

49 "access": "public"

50 },

51 "engines": {

52 "node": ">=18"

53 },

54 "scripts": {

55 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "test": "bash tests/run-tests.sh && python3 tests/test_selector.py"

57 },

58 "dependencies": {

59 "update-notifier": "^7.3.1"

60 }

61}

62

install.shView file

•path = install.sh kind = build_helper sizeBytes = 22327 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/multiacc-selectView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/multiacc-selectView on unpkg

bin/claudeView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.22 matchedPath = bin/claude matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.22 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/claudeView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@2.0.19 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.19 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claudeView on unpkg

bin/cli.mjsView file

•matchType = malicious_source_fingerprint_signature signature = d80f1af7d3d7e108 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = claude-multiacc@2.0.22 matchedPath = bin/cli.mjs matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.22 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.mjsView on unpkg