Loading npm security reports…

claude-multiacc@2.0.30: AI-agent control-surface risk | LPM Firewall

registry / claude-multiacc / 2.0.30

claude-multiacc@2.0.30

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global install silently modifies shell command resolution and creates persistent scheduled jobs. Those jobs repeatedly invoke account-management code and can automatically reinstall this package.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install -g claude-multiacc, followed by shell startup or scheduled job execution.

Impact

Claude and Codex invocations can be redirected through the package, which rotates subscription accounts and can transfer portable tokens to a configured server.

Mechanism

Postinstall PATH shadowing, scheduler persistence, and automated package self-update.

Policy narrative

A global npm installation runs a postinstall hook that launches install.sh. The installer modifies shell startup files so its Claude and Codex shims take precedence, then creates launchd or cron jobs that refresh accounts and perform daily self-updates. The shims rotate subscription identities for normal AI CLI commands, and the account tool can copy portable tokens to a remote target. This is an unconsented persistent interception of foreign AI command surfaces.

AI rationale

The package combines an automatic install hook with persistent PATH shadowing of Claude and Codex, scheduled execution, and automated self-reinstallation. This is a concrete broad AI-agent control-surface mutation rather than a passive CLI utility.

Evidence

scripts/postinstall.mjsinstall.shlib/install_actions.shbin/codexbin/claude-accountsbin/claude$HOME/.zshenv$HOME/.zprofile$HOME/.zshrc

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10485 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claude-accountsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claude-accountsView on unpkg

scripts/postinstall.mjsView file

19// Only auto-run for a real global install. `npm[redacted]` is set by npm for -g. if (process.env.CLAUDE_MULTIACC_SKIP_POSTINSTALL === '1') skip('CLAUDE_MULTIACC_SKIP_POSTINSTALL=1'); if (process.env.CI) skip('CI environment'); const isGlobal = process.env.npm[redacted] === 'true' || process.env.npm[redacted] === '1'; if (!isGlobal) skip('local/dev install — not global'); if (process.platform === 'win32') skip('Windows is not supported by the shim'); console.log('claude-multiacc: configuring the PATH shim + scheduled jobs (install.sh)…'); const r = spawnSync('bash', [join(ROOT

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs the installer during global npm installation.

scripts/postinstall.mjsView on unpkg · L19

lib/install_actions.shView file

157install_mac_paths() { # .zshenv covers non-interactive zsh; the .zshrc block must be LAST so it wins # over ~/.local/bin re-prepends done earlier in .zshrc/.zprofile. # zsh reads: .zshenv always; .zprofile for login; .zshrc for interactive. # The block must end each file that later re-prepends ~/.local/bin. if [ -z "$INSTANCE" ]; then touch "$HOME/.zshenv" append_block "$HOME/.zshenv" touch "$HOME/.zprofile" append_block "$HOME/.zprofile" touch "$HOME/.zshrc" append_block "$HOME/.zshrc" [ -f "$HOME/.bash_profile" ] && append_block "$HOME/.bash_profile"

High

Ai Review Evidence

The installer prepends package shims to shell startup files, replacing normal Claude and Codex command resolution.

lib/install_actions.shView on unpkg · L157

Source & flagged code

7 flagged

package.jsonView file

Lines 37-67json

37 ],

38 "author": {

39 "name": "Gowalk"

40 },

41 "license": "MIT",

42 "repository": {

43 "type": "git",

44 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

45 },

46 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

47 "bugs": {

48 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

49 },

50 "publishConfig": {

51 "access": "public"

52 },

53 "engines": {

54 "node": ">=18"

55 },

56 "scripts": {

57 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "test": "npm run test:core && npm run test:seeding && npm run test:commands",

59 "test:core": "bash tests/run-tests.sh && python3 tests/test_selector.py",

60 "test:seeding": "python3 tests/test_account_seeding.py",

61 "test:commands": "python3 tests/test_packaged_commands.py"

62 },

63 "dependencies": {

64 "update-notifier": "^7.3.1"

65 }

66}

67

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10485 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claude-accountsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claude-accountsView on unpkg

scripts/postinstall.mjsView file

19// Only auto-run for a real global install. `npm[redacted]` is set by npm for -g. if (process.env.CLAUDE_MULTIACC_SKIP_POSTINSTALL === '1') skip('CLAUDE_MULTIACC_SKIP_POSTINSTALL=1'); if (process.env.CI) skip('CI environment'); const isGlobal = process.env.npm[redacted] === 'true' || process.env.npm[redacted] === '1'; if (!isGlobal) skip('local/dev install — not global'); if (process.platform === 'win32') skip('Windows is not supported by the shim'); console.log('claude-multiacc: configuring the PATH shim + scheduled jobs (install.sh)…'); const r = spawnSync('bash', [join(ROOT

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs the installer during global npm installation.

scripts/postinstall.mjsView on unpkg · L19

lib/install_actions.shView file

Lines 137-177text

137doc['server'] = sys.argv[2]

138with open(sys.argv[1] + '.tmp', 'w') as f:

139 json.dump(doc, f, indent=2)

140 f.write('\n')

141os.replace(sys.argv[1] + '.tmp', sys.argv[1])

142PYEOF

143 fi

144 if sync_target_is_local "$(sync_target)"; then

145 echo " account pool: $ACC_ROOT (manifest ready; sync target: none — local-only)"

146 else

147 echo " account pool: $ACC_ROOT (manifest ready; sync target: $(sync_target))"

148 fi

149