claude-multiacc@2.0.58
Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe global postinstall performs first-party CLI and shell setup that can redirect Claude command resolution, so it merits a warning. The inspected source does not establish malicious behavior, and the scanner’s test-file payload signal is a small image fixture.
Decision evidence
public snapshot- The package runs a postinstall hook that launches install.sh after a global install.
- The installer adds its shim directory to the front of PATH in shell startup files, affecting which Claude command runs.
- A test payload flagged by the scanner is a minimal base64 image fixture, not an executable payload.
- Postinstall skips local installs, CI, Windows, and installs with the explicit skip variable set.
- The installer and PATH shim are part of the package’s stated account-pooling CLI setup; no concrete malicious behavior was identified in the inspected excerpts.
Source & flagged code
7 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package runs a postinstall hook that launches install.sh after a global install.
package.jsonView on unpkg · L57Findings
Affected versions and remediation
This report applies to claude-multiacc@2.0.58.
See all versions of claude-multiacc for other recorded verdicts.
- Review the evidence and your use of claude-multiacc@2.0.58 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.