Loading npm security reports…

claude-multiacc@2.0.24: Malicious npm security report (Block) | LPM Firewall

registry / claude-multiacc / 2.0.24

claude-multiacc@2.0.24

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

A global install automatically persists PATH shims over Claude and Codex and creates scheduled jobs. The installed account workflow defaults to sending Claude setup tokens to a hard-coded remote server.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Global npm installation, followed by a Claude account mutation on macOS.

Impact

Future Claude and Codex invocations can be intercepted, and portable Claude credentials can be sent to the package operator's server.

Mechanism

Persistent AI CLI shadowing with automatic credential synchronization.

Attack narrative

On global installation, postinstall runs install.sh without a separate command. The installer modifies shell startup paths to place its Claude and Codex shims first and creates recurring cron jobs, including a daily self-update. It initializes the account system with root@138.197.36.107 as the default remote target. When a Claude account is imported or otherwise mutated on macOS, automatic sync runs and rsync transfers server.token to that target. This combines persistence, interception of AI command execution, and credential transfer to a hard-coded third-party host.

AI rationale

This package performs unconsented install-time mutation of broad Claude and Codex control surfaces, persists itself, and configures automatic credential synchronization to a hard-coded remote host. The global-install guard does not neutralize the concrete persistence and token-exfiltration chain.

Evidence

scripts/postinstall.mjsinstall.shlib/common.shbin/claude-accounts$HOME/.zshenv

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 22327 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/multiacc-selectView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/multiacc-selectView on unpkg

bin/claudeView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.23 matchedPath = bin/claude matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/claudeView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@2.0.19 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.19 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claudeView on unpkg

bin/cli.mjsView file

•matchType = malicious_source_fingerprint_signature signature = d80f1af7d3d7e108 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = claude-multiacc@2.0.23 matchedPath = bin/cli.mjs matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.23 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 35-62json

35 ],

36 "author": {

37 "name": "Gowalk"

38 },

39 "license": "MIT",

40 "repository": {

41 "type": "git",

42 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

43 },

44 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

45 "bugs": {

46 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

47 },

48 "publishConfig": {

49 "access": "public"

50 },

51 "engines": {

52 "node": ">=18"

53 },

54 "scripts": {

55 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "test": "bash tests/run-tests.sh && python3 tests/test_selector.py"

57 },

58 "dependencies": {

59 "update-notifier": "^7.3.1"

60 }

61}

62

install.shView file

•path = install.sh kind = build_helper sizeBytes = 22327 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/multiacc-selectView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/multiacc-selectView on unpkg

bin/claudeView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.23 matchedPath = bin/claude matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/claudeView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = claude-multiacc@2.0.19 matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.19 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claudeView on unpkg

bin/cli.mjsView file

•matchType = malicious_source_fingerprint_signature signature = d80f1af7d3d7e108 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = claude-multiacc@2.0.23 matchedPath = bin/cli.mjs matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.23 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.mjsView on unpkg