registry / AI-agent control-surface risk / claude-switcher-core

claude-switcher-core

Troca de conta do Claude Code (Claude CLI) — núcleo compartilhado pelos wrappers de fish, bash/zsh e PowerShell.

This report shows the evidence for claude-switcher-core@1.0.0, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The lifecycle hook makes persistent, unprompted changes to user shell profiles and shadows the Claude command. This meets the firewall block policy despite no observed exfiltration.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Future shell sessions route `claude` through package-controlled logic.

Mechanism

automatic shell-profile injection and Claude command wrapping

Policy narrative

On npm postinstall, the package automatically detects shells, copies its Fish functions, and adds source directives to Bash/Zsh profiles. Those startup changes define a `claude` wrapper that routes future Claude Code invocations through the package. This is an unconsented install-time mutation of a broad AI-agent command control surface.

AI rationale

The lifecycle hook makes persistent, unprompted changes to user shell profiles and shadows the Claude command. This meets the firewall block policy despite no observed exfiltration.

Evidence

scripts/postinstall.jslib/shell-integration.jsshell/claude-switcher.sh~/.config/fish/functions/*~/.config/fish/conf.d/*~/.bashrc~/.zshrcPowerShell profile files

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.

Evidence for policy risk

postinstall invokes shell integration without consent.
Lifecycle code writes shell startup files and copies functions.
Installed wrapper intercepts the `claude` command.

Evidence against

No credential exfiltration or arbitrary remote payload loading found.
Claude Code installation is gated by an interactive confirmation.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 29.5 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 4-31json

4 "description": "Troca de conta do Claude Code (Claude CLI) — núcleo compartilhado pelos wrappers de fish, bash/zsh e PowerShell.",

5 "license": "MIT",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/ArthurViniciusBA1/claude-code-multi-account.git"

9 },

10 "homepage": "https://github.com/ArthurViniciusBA1/claude-code-multi-account",

11 "bin": {

12 "claude-switcher-core": "bin/core.js"

13 },

14 "files": [

15 "bin",

16 "lib",

17 "scripts",

18 "functions",

19 "conf.d",

20 "shell",

21 "powershell"

22 ],

23 "scripts": {

24 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "preuninstall": "node scripts/preuninstall.js"

26 },

27 "engines": {

28 "node": ">=18"

29 }

30}

bin/core.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('node:fs');

5const os = require('node:os');

lib/shell-integration.jsView file

Lines 1-22javascript

1'use strict';

2// Lógica de configurar/remover a integração de cada shell (fish, bash,

3// zsh, PowerShell). Compartilhada entre scripts/postinstall.js,

4// scripts/preuninstall.js e bin/core.js — pra não duplicar a mesma coisa

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/shell-integration.jsView on unpkg · L2

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/shell-integration.jsView on unpkg · L2

5// em três lugares.

shell/claude-switcher.shView file

•path = shell/claude-switcher.sh kind = build_helper sizeBytes = 1499 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

shell/claude-switcher.shView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/core.jsView file

3L4: const fs = require('node:fs'); L5: const os = require('node:os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/core.jsView on unpkg · L3

Findings

2 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Persistencelib/shell-integration.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/core.js

MediumEnvironment Vars

MediumInstall Persistencelib/shell-integration.js

MediumShips Build Helpershell/claude-switcher.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to claude-switcher-core@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing claude-switcher-core@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-20 16:20:50.323Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 19, 2026, 6:57 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code