Loading npm security reports…

claude-multiacc@2.0.31: AI-agent control-surface risk | LPM Firewall

registry / claude-multiacc / 2.0.31

claude-multiacc@2.0.31

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically changes shell command resolution for Claude and Codex and creates persistent scheduled jobs. The package also configures a hard-coded remote sync target that can receive Claude setup tokens during account synchronization.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Global npm installation or update triggers postinstall.

Impact

Subsequent Claude and Codex invocations can be routed through package-controlled shims; recurring jobs can maintain and update that control surface.

Mechanism

PATH shadowing, scheduled persistence, and remote token synchronization.

Policy narrative

On global installation, postinstall runs install.sh without an interactive setup command. The installer edits shell startup files to place its Claude and Codex shims first on PATH, creates scheduled jobs including daily self-update, and initializes account pools. The package hard-codes an SSH destination and its sync logic transfers Claude setup-token files there. This is an unconsented lifecycle takeover of broad AI-agent command surfaces with persistence.

AI rationale

The package's global postinstall automatically installs PATH-shadowing Claude and Codex shims plus persistent schedulers. Its hard-coded remote sync target and setup-token transfer create a concrete credential-exposure path after account setup.

Evidence

package.jsonscripts/postinstall.mjslib/install_actions.shinstall.shlib/common.shbin/claude-accounts~/.zshenv

Source & flagged code

7 flagged

package.jsonView file

Lines 36-68json

36 "gowalk"

37 ],

38 "author": {

39 "name": "Gowalk"

40 },

41 "license": "MIT",

42 "repository": {

43 "type": "git",

44 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

45 },

46 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

47 "bugs": {

48 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

49 },

50 "publishConfig": {

51 "access": "public"

52 },

53 "engines": {

54 "node": ">=18"

55 },

56 "scripts": {

57 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "test": "npm run test:core && npm run test:seeding && npm run test:commands",

High

Suspicious Lifecycle Evidence

The install lifecycle automatically runs the installer during global npm installation.

package.jsonView on unpkg · L56

59 "test:core": "bash tests/run-tests.sh && python3 tests/test_selector.py",

60 "test:seeding": "python3 tests/test_account_seeding.py && npm run test:codex-settings",

61 "test:codex-settings": "python3 tests/test_codex_config_edit.py && python3 tests/test_codex_settings.py",

62 "test:commands": "python3 tests/test_packaged_commands.py"

63 },

64 "dependencies": {

65 "update-notifier": "^7.3.1"

66 }

67}

68

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10485 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claude-accountsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claude-accountsView on unpkg

bin/codexView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.29 matchedPath = bin/codex matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/codexView on unpkg