claude-multiacc@2.0.45

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Source inspection supports a product-aligned account-management CLI with guarded global-install setup. The postinstall side effect is real, but inspected code does not establish exfiltration, destructive behavior, or malicious control-surface mutation.

Static reason

One or more suspicious static signals were detected.

Trigger

A global npm install or update, unless CI, skip, or platform guards apply.

Impact

User-level command routing and scheduled task configuration may be changed as part of setup.

Mechanism

The postinstall script launches the bundled install.sh setup script; the installer describes a PATH-shadowing addon and scheduled jobs.

AI rationale

Evidence

install.shscripts/postinstall.mjs

Decision evidence

public snapshot

AI called this Clean at 78.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall runs a Node setup script; that script skips CI and non-global installs and only then invokes install.sh.
The flagged test file contains unit-test framing and describes sandboxed fixtures.
The flagged account entrypoint is a Bash account-pool manager and sources its local common library.
The installer is an explicitly invoked shell addon installer; the inspected source did not establish a malicious action.

Evidence against

Global npm installation automatically runs install.sh, which configures a PATH shim and scheduled jobs.
The installer changes user-level command routing and scheduling, creating a real setup side effect.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.59 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 36-68json

36 "gowalk"

37 ],

38 "author": {

39 "name": "Gowalk"

40 },

41 "license": "MIT",

42 "repository": {

43 "type": "git",

44 "url": "git+https://github.com/gowalk-public/claude-multiacc.git"

45 },

46 "homepage": "https://github.com/gowalk-public/claude-multiacc#readme",

47 "bugs": {

48 "url": "https://github.com/gowalk-public/claude-multiacc/issues"

49 },

50 "publishConfig": {

51 "access": "public"

52 },

53 "engines": {

54 "node": ">=18"

55 },

56 "scripts": {

57 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "test": "npm run test:core && npm run test:seeding && npm run test:commands",

59 "test:core": "bash tests/run-tests.sh && python3 tests/test_selector.py && python3 tests/test_shim_path.py",

Low

Suspicious Lifecycle Evidence

The postinstall runs a Node setup script; that script skips CI and non-global installs and only then invokes install.sh.

package.jsonView on unpkg · L56

60 "test:seeding": "python3 tests/test_account_seeding.py && python3 tests/test_mcp_registry.py && npm run test:codex-settings",

61 "test:codex-settings": "python3 tests/test_codex_config_edit.py && python3 tests/test_codex_settings.py",

62 "test:commands": "python3 tests/test_packaged_commands.py"

63 },

64 "dependencies": {

65 "update-notifier": "^7.3.1"

66 }

67}

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10485 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_autoresume.pyView file

Lines 1-21text

1#!/usr/bin/env python3

2"""Unit tests for lib/autoresume.py — the auto-resume watcher (docs/AUTORESUME.md).

4Sandboxed: no real claude/codex, no network, no quota, never the operator's pools. Every

5pool is a temp dir; fixture records are inline, in the shapes the live clients write

Low

Ai Review Evidence

The flagged test file contains unit-test framing and describes sandboxed fixtures.

tests/test_autoresume.pyView on unpkg · L1

6(claude 2.1.280 transcripts, codex 0.156.0 rollouts, 2026-09-22); every process side

7effect of the watcher goes through a fake Runner with a fake clock. One test drives the

8real ``watch`` CLI end to end against a disposable ``sleep`` process, a fake ``tmux`` on

9PATH and a fake probe script. Runs under python3.9+.

bin/claude-accountsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claude-accountsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

56"scripts": { "postinstall": "node scripts/postinstall.mjs", "test": "npm run test:core && npm run test:seeding && npm run test:commands", "test

Low

Suspicious Lifecycle Evidence

The postinstall runs a Node setup script; that script skips CI and non-global installs and only then invokes install.sh.

package.jsonView on unpkg · L56

install.shView file

Findings

3 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirtests/test_autoresume.py

HighSemantic Analysis Limitedbin/claude-accounts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencetests/test_autoresume.py

Affected versions and remediation

This report applies to claude-multiacc@2.0.45.

See all versions of claude-multiacc for other recorded verdicts.

Review the evidence and your use of claude-multiacc@2.0.45 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 16:18:05.992Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.