Loading npm security reports…

claude-multiacc@2.0.32: Malicious npm security report (Block) | LPM Firewall

registry / claude-multiacc / 2.0.32

claude-multiacc@2.0.32

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

A global npm install automatically alters the command resolution and scheduled execution environment for Claude Code and Codex. It also schedules unattended updates that reinstall the package.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Running npm install -g claude-multiacc or a scheduled cron or launchd job afterward.

Impact

Subsequent claude and codex commands can be intercepted and run through package-controlled account and credential logic; future releases are installed automatically.

Mechanism

Postinstall PATH shadowing, command shims, persistence, and automatic self-update.

Attack narrative

On global installation, npm automatically invokes install.sh. That installer places the package bin directory ahead of normal command paths, can create system-wide claude and codex symlinks, and installs recurring jobs. The shims intercept the original AI command names. A daily scheduled task checks npm and installs claude-multiacc@latest, re-triggering postinstall and preserving the control chain without a new explicit setup command.

AI rationale

This is an unconsented postinstall mutation of a broad AI-agent control surface: it shadows Claude and Codex commands, persists scheduled jobs, and self-updates. The global-install guard does not remove the automatic lifecycle behavior or its control over later command execution.

Evidence

package.jsonscripts/postinstall.mjsinstall.shlib/install_actions.shbin/codexbin/codex-accounts$HOME/.zshenv

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10485 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claude-accountsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claude-accountsView on unpkg

bin/codexView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.31 matchedPath = bin/codex matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/codexView on unpkg

bin/cli.mjsView file

•matchType = malicious_source_fingerprint_signature signature = ac93055402834e51 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = claude-multiacc@2.0.31 matchedPath = bin/cli.mjs matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.31 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 37-68json

37 ],

38 "author": {

39 "name": "Gowalk"

40 },

41 "license": "MIT",

42 "repository": {

43 "type": "git",

44 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

45 },

46 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

47 "bugs": {

48 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

49 },

50 "publishConfig": {

51 "access": "public"

52 },

53 "engines": {

54 "node": ">=18"

55 },

56 "scripts": {

57 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "test": "npm run test:core && npm run test:seeding && npm run test:commands",

59 "test:core": "bash tests/run-tests.sh && python3 tests/test_selector.py",

60 "test:seeding": "python3 tests/test_account_seeding.py && npm run test:codex-settings",

61 "test:codex-settings": "python3 tests/test_codex_config_edit.py && python3 tests/test_codex_settings.py",

62 "test:commands": "python3 tests/test_packaged_commands.py"

63 },

64 "dependencies": {

65 "update-notifier": "^7.3.1"

66 }

67}

68

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10485 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 23183 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

bin/claude-accountsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claude-accountsView on unpkg

bin/codexView file

•matchType = normalized_sha256 matchedPackage = claude-multiacc@2.0.31 matchedPath = bin/codex matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/codexView on unpkg

bin/cli.mjsView file

•matchType = malicious_source_fingerprint_signature signature = ac93055402834e51 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = claude-multiacc@2.0.31 matchedPath = bin/cli.mjs matchedIdentity = npm:Y2xhdWRlLW11bHRpYWNj:2.0.31 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.mjsView on unpkg