Loading npm security reports…

claude-multiacc@2.0.5: AI-agent control-surface risk | LPM Firewall

registry / claude-multiacc / 2.0.5

claude-multiacc@2.0.5

Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global install changes shell command resolution so the package intercepts Claude and Codex invocations, then installs background jobs. This is an unconsented lifecycle mutation of a broad AI-agent control surface.

Static reason

One or more suspicious static signals were detected.

Trigger

A non-CI global npm installation on macOS or Linux.

Impact

Future Claude and Codex invocations and scheduled jobs run package-controlled code, including automatic updates.

Mechanism

Postinstall runs an installer that shadows agent commands and adds persistent schedulers.

Policy narrative

On a global npm install, the postinstall hook runs install.sh without a separate setup command. The installer modifies shell startup files to place its own Claude and Codex shims first, installs recurring launchd or cron jobs, and schedules daily package updates. When run as root, it redirects system command paths to its shims. This gives the package persistent control over broad AI-agent command execution.

Rationale

The guarded global trigger does not make the lifecycle mutation consented: installation automatically rewrites broad shell and agent command surfaces and adds persistence. This meets the policy threshold for malicious install-hook abuse.

Evidence

package.jsonscripts/postinstall.mjsinstall.shlib/common.sh$HOME/.zshenv$HOME/.zprofile$HOME/.zshrc$HOME/.bashrc$HOME/Library/LaunchAgents/com.claude-multiacc*.plist/usr/local/bin/claude

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

445touch "$HOME/.zshenv" append_block "$HOME/.zshenv" touch "$HOME/.zprofile" append_block "$HOME/.zprofile" touch "$HOME/.zshrc" append_block "$HOME/.zshrc" [ -f "$HOME/.bash_profile" ] && append_block "$HOME/.bash_profile" [ -f "$HOME/.bashrc" ] && append_block "$HOME/.bashrc" echo " PATH block: end of ~/.zshenv, ~/.zprofile, ~/.zshrc (+ bash rc files if present)"

High

Ai Review Evidence

The installer prepends package shims to shell startup files, intercepting Claude and Codex commands.

install.shView on unpkg · L445

213<key>Label</key><string>$LABEL.update</string> <key>ProgramArguments</key><array> <string>$REPO_DIR/bin/claude-accounts</string> <string>self-update</string> <string>--quiet</string> </array> $(plist_env_block) <key>StartCalendarInterval</key><dict> <key>Hour</key><integer>4</integer> <key>Minute</key><integer>7</integer>

High

Ai Review Evidence

It creates recurring background jobs and enables a daily self-update job.

install.shView on unpkg · L213

469if [ "$(id -u)" = "0" ]; then if [ -e /usr/local/bin/claude ] && [ ! -L /usr/local/bin/claude ]; then echo " WARNING: /usr/local/bin/claude exists and is a real file — NOT overwriting." >&2 else ln -sfn "$REPO_DIR/bin/claude" /usr/local/bin/claude echo " shim: /usr/local/bin/claude -> $REPO_DIR/bin/claude (systemd-PATH compatible)" fi if [ -e /usr/local/bin/codex ] && [ ! -L /usr/local/bin/codex ]; then echo " WARNING: /usr/local/bin/codex exists and is a real file — NOT overwriting." >&2 else ln -sfn "$REPO_DIR/bin/c

High

Ai Review Evidence

Root installs replace the system Claude and Codex command paths with package symlinks.

install.shView on unpkg · L469

•path = install.sh kind = build_helper sizeBytes = 22327 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/test_selector.pyView file

•path = tests/test_selector.py kind = payload_in_excluded_dir sizeBytes = 11717 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_selector.pyView on unpkg

Lines 425-489text

425 echo " WARNING: codex pool init failed (codex-accounts init-pool)" >&2

426 else

427 echo " codex account pool: $CODEX_ACC_ROOT (manifest ready)"

428 fi

429

430 # An INSTANCE install never rewrites the shell rc blocks: one interactive PATH

431 # cannot serve two pools, and clobbering the default install's block would point

432 # the operator's shell at an instance pool. Its agents (below) carry the roots

433 # instead, and the runner daemon invokes the shims by absolute path.

434 if [ -n "$INSTANCE" ]; then

435 echo " PATH block: skipped (instance install) — for a shell against this pool:"

436 echo " export CLAUDE_ACCOUNTS_ROOT='$ACC_ROOT' CODEX_ACCOUNTS_ROOT='$CODEX_ACC_ROOT'"

437 echo " export PATH=\"$REPO_DIR/bin:\$PATH\""

438 fi

439 if [ "$kind" = "mac" ]; then

440 # .zshenv covers non-interactive zsh; the .zshrc block must be LAST so it wins

441 # over ~/.local/bin re-prepends done earlier in .zshrc/.zprofile.

442 # zsh reads: .zshenv always; .zprofile for login; .zshrc for interactive.

443 # The block must end each file that later re-prepends ~/.local/bin.

444 if [ -z "$INSTANCE" ]; then

445 touch "$HOME/.zshenv"

446 append_block "$HOME/.zshenv"

447 touch "$HOME/.zprofile"

448 append_block "$HOME/.zprofile"

449 touch "$HOME/.zshrc"

450 append_block "$HOME/.zshrc"

451 [ -f "$HOME/.bash_profile" ] && append_block "$HOME/.bash_profile"

452 [ -f "$HOME/.bashrc" ] && append_block "$HOME/.bashrc"

453 echo " PATH block: end of ~/.zshenv, ~/.zprofile, ~/.zshrc (+ bash rc files if present)"

High

Ai Review Evidence

The installer prepends package shims to shell startup files, intercepting Claude and Codex commands.

install.shView on unpkg · L445

454 fi

455 [ "$NO_SCHEDULE" = "1" ] || mac_schedule_install

456 else

457 if [ -z "$INSTANCE" ]; then

458 touch "$HOME/.bashrc"

459 append_block "$HOME/.bashrc"

460 if [ -w /etc/profile.d ] 2>/dev/null || [ "$(id -u)" = "0" ]; then

461 {

462 printf '%s\n' "$MARK_BEGIN"

463 path_block_body

464 printf '%s\n' "$MARK_END"

465 } > "$PROFILED"

466 echo " PATH block: ~/.bashrc + $PROFILED"

467 fi

468 fi

469 if [ "$(id -u)" = "0" ]; then

470 if [ -e /usr/local/bin/claude ] && [ ! -L /usr/local/bin/claude ]; then

471 echo " WARNING: /usr/local/bin/claude exists and is a real file — NOT overwriting." >&2

472 else

473 ln -sfn "$REPO_DIR/bin/claude" /usr/local/bin/claude

474 echo " shim: /usr/local/bin/claude -> $REPO_DIR/bin/claude (systemd-PATH compatible)"

475 fi

476 if [ -e /usr/local/bin/codex ] && [ ! -L /usr/local/bin/codex ]; then

477 echo " WARNING: /usr/local/bin/codex exists and is a real file — NOT overwriting." >&2

478 else

479 ln -sfn "$REPO_DIR/bin/codex" /usr/local/bin/codex

High

Ai Review Evidence

Root installs replace the system Claude and Codex command paths with package symlinks.

install.shView on unpkg · L469

480 echo " shim: /usr/local/bin/codex -> $REPO_DIR/bin/codex (systemd-PATH compatible)"

481 fi

482 fi

483 [ "$NO_SCHEDULE" = "1" ] || linux_schedule_install

484 fi

485

486 echo

487 echo "install complete. Open a new shell (or 'export PATH=\"$REPO_DIR/bin:\$PATH\"'), then:"

488 echo " claude-accounts list # the Claude Code pool"

489 echo " codex-accounts list # the Codex pool"