registry / claude-multiacc / 2.0.7
claude-multiacc@2.0.7
Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe postinstall hook is gated to global installs and skips CI or an explicit opt-out; it invokes this package’s installer. The inspected selector and its tests show input validation and account-selection behavior, with no confirmed malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
A global npm install can trigger postinstall; invoking the selector requires its specified command-line arguments.
Impact
No confirmed malicious effect or attack surface was established by the inspected source.
Mechanism
Postinstall invokes the package’s installer after its skip checks. The selector reads and validates JSON from standard input.
AI rationale
The postinstall hook is gated to global installs and skips CI or an explicit opt-out; it invokes this package’s installer. The inspected selector and its tests show input validation and account-selection behavior, with no confirmed malicious chain.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points postinstall to a package script.
- The selector accepts a fixed JSON stdin protocol and validates its input.
- Selector tests cover configuration and validation of account-selection policy.
- Postinstall skips CI and non-global installs and can be explicitly disabled.
Evidence against
- A global npm install can automatically invoke the package’s installer.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg54"scripts": {
"postinstall": "node scripts/postinstall.mjs",
"test": "bash tests/run-tests.sh && python3 tests/test_selector.py"
Low
Suspicious Lifecycle Evidence
The manifest points postinstall to a package script.
package.jsonView on unpkg · L54install.shView file
Findings
3 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirtests/test_selector.py
HighSemantic Analysis Limitedbin/multiacc-select
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/multiacc-select
Affected versions and remediation
This report applies to claude-multiacc@2.0.7.
See all versions of claude-multiacc for other recorded verdicts.
- Review the evidence and your use of claude-multiacc@2.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.