Loading npm security reports…

claude-multiacc@2.0.28: AI-agent control-surface risk | LPM Firewall

registry / claude-multiacc / 2.0.28

claude-multiacc@2.0.28

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically persists shims and recurring jobs that intercept Claude and Codex commands. It changes broad AI-agent command control surfaces before any separate setup command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g claude-multiacc

Impact

Future Claude and Codex invocations can be redirected through package-controlled code; scheduled jobs also perform account operations and automatic updates.

Mechanism

Postinstall launches a PATH-shadowing installer that creates persistent scheduled jobs and command shims.

Policy narrative

On global installation, npm runs the package postinstall, which invokes install.sh without a separate setup action. The installer prepends its directory to shell PATH files, can install /usr/local/bin Claude and Codex shims, and creates recurring launchd or cron jobs, including automatic updates. Those changes make later AI-agent commands run package-controlled wrappers and persist after the install command ends.

AI rationale

This is an automatic postinstall mutation of broad, foreign Claude and Codex command control surfaces, with persistence and automatic updating. The global-install guard does not provide separate consent for these changes.

Evidence

package.jsonscripts/postinstall.mjsinstall.shlib/install_actions.shlib/common.sh$HOME/.zshenv$HOME/.zprofile$HOME/.zshrc$HOME/.bash_profile

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10485 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claude-accountsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claude-accountsView on unpkg

bin/codexView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.32 matchedPath = bin/codex matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.32 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/codexView on unpkg

scripts/postinstall.mjsView file

19// Only auto-run for a real global install. `npm[redacted]` is set by npm for -g. if (process.env.CLAUDE_MULTIACC_SKIP_POSTINSTALL === '1') skip('CLAUDE_MULTIACC_SKIP_POSTINSTALL=1'); if (process.env.CI) skip('CI environment'); const isGlobal = process.env.npm[redacted] === 'true' || process.env.npm[redacted] === '1'; if (!isGlobal) skip('local/dev install — not global'); if (process.platform === 'win32') skip('Windows is not supported by the shim'); console.log('claude-multiacc: configuring the PATH shim + scheduled jobs (install.sh)…'); const r = spawnSync('bash', [join(ROOT

High

Suspicious Lifecycle Evidence

The npm postinstall automatically runs the installer during global installation.

scripts/postinstall.mjsView on unpkg · L19

Source & flagged code

7 flagged

package.jsonView file

Lines 37-65json

37 ],

38 "author": {

39 "name": "Gowalk"

40 },

41 "license": "MIT",

42 "repository": {

43 "type": "git",

44 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

45 },

46 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

47 "bugs": {

48 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

49 },

50 "publishConfig": {

51 "access": "public"

52 },

53 "engines": {

54 "node": ">=18"

55 },

56 "scripts": {

57 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "test": "bash tests/run-tests.sh && python3 tests/test_selector.py && npm run test:commands",

59 "test:commands": "python3 tests/test_packaged_commands.py"

60 },

61 "dependencies": {

62 "update-notifier": "^7.3.1"

63 }

64}

65

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10485 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claude-accountsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claude-accountsView on unpkg

bin/codexView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.32 matchedPath = bin/codex matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.32 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/codexView on unpkg

scripts/postinstall.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// Runs after `npm install`. On a GLOBAL install/update it wires the addon up by

3// running install.sh (idempotent), so `npm i -g claude-multiacc@latest` fully updates

4// the shim, CLI, and scheduled jobs with no extra step. Deliberately best-effort:

5// npm's own CI, sandboxes, and non-global/dev installs must never be broken by it, and

6// a failed install.sh must not fail `npm install` — it only prints how to finish by hand.

7import { spawnSync } from 'node:child_process';

8import { fileURLToPath }