Loading npm security reports…

claude-multiacc@2.0.29: Malicious npm security report (Block) | LPM Firewall

registry / claude-multiacc / 2.0.29

claude-multiacc@2.0.29

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Global installation automatically alters Claude and Codex command resolution, installs recurring jobs, and enables self-updating. Scheduled processing can contact a package-chosen default SSH destination.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g claude-multiacc

Impact

Future Claude and Codex invocations can be routed through package shims; recurring jobs can update the package and send account-pool state to the configured remote host.

Mechanism

Postinstall persistence, PATH shim takeover, scheduled self-update, and remote state distribution.

Attack narrative

On global installation, the postinstall hook launches the installer without an explicit setup command. The installer changes shell startup PATH order so its Claude and Codex shims run first, creates scheduled launchd or cron jobs, and enables daily package updates. It seeds a default root SSH server and scheduled limits processing starts a detached distribution process. This is persistent, unconsented control of broad AI-agent command surfaces with a recurring remote-update path.

AI rationale

This package combines an automatic install lifecycle with broad AI-agent command interception, persistence, a default remote target, and automatic self-updating. These are concrete install-hook abuse behaviors rather than a user-invoked setup utility.

Evidence

scripts/postinstall.mjsinstall.shlib/install_actions.shlib/common.shbin/claude-accounts$HOME/.zshenv$HOME/.zprofile$HOME/.zshrc

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10485 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claude-accountsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claude-accountsView on unpkg

bin/codexView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.30 matchedPath = bin/codex matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/codexView on unpkg

scripts/postinstall.mjsView file

19// Only auto-run for a real global install. `npm[redacted]` is set by npm for -g. if (process.env.CLAUDE_MULTIACC_SKIP_POSTINSTALL === '1') skip('CLAUDE_MULTIACC_SKIP_POSTINSTALL=1'); if (process.env.CI) skip('CI environment'); const isGlobal = process.env.npm[redacted] === 'true' || process.env.npm[redacted] === '1'; if (!isGlobal) skip('local/dev install — not global'); if (process.platform === 'win32') skip('Windows is not supported by the shim'); console.log('claude-multiacc: configuring the PATH shim + scheduled jobs (install.sh)…'); const r = spawnSync('bash', [join(ROOT

High

Ai Review Evidence

A global npm install automatically runs the installer.

scripts/postinstall.mjsView on unpkg · L19

Source & flagged code

7 flagged

package.jsonView file

Lines 37-65json

37 ],

38 "author": {

39 "name": "Gowalk"

40 },

41 "license": "MIT",

42 "repository": {

43 "type": "git",

44 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

45 },

46 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

47 "bugs": {

48 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

49 },

50 "publishConfig": {

51 "access": "public"

52 },

53 "engines": {

54 "node": ">=18"

55 },

56 "scripts": {

57 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "test": "bash tests/run-tests.sh && python3 tests/test_selector.py && npm run test:commands",

59 "test:commands": "python3 tests/test_packaged_commands.py"

60 },

61 "dependencies": {

62 "update-notifier": "^7.3.1"

63 }

64}

65

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10485 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claude-accountsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claude-accountsView on unpkg

bin/codexView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.30 matchedPath = bin/codex matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/codexView on unpkg

scripts/postinstall.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// Runs after `npm install`. On a GLOBAL install/update it wires the addon up by

3// running install.sh (idempotent), so `npm i -g claude-multiacc@latest` fully updates

4// the shim, CLI, and scheduled jobs with no extra step. Deliberately best-effort:

5// npm's own CI, sandboxes, and non-global/dev installs must never be broken by it, and

6// a failed install.sh must not fail `npm install` — it only prints how to finish by hand.

7import { spawnSync } from 'node:child_process';

8import { fileURLToPath }