@qwen-code/qwen-code@0.19.3: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@qwen-code/qwen-code@0.19.3: Clean npm security report (Allow) | LPM Firewall

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

CLI can install Qwen skills/extensions and configure MCP servers when explicitly invoked.
Ships native ripgrep binaries and tree-sitter wasm used as bundled tooling.

Evidence against

package.json has no lifecycle scripts; install does not execute package code.
bin qwen points to cli-entry.js, which only respawns Node with --expose-gc or imports cli.js for serve.
Extension/skill install paths show consent text, GitHub-only HTTPS allowlist, redirect host checks, and size limits.
Settings/MCP writes are exposed through qwen serve RPC or slash/CLI workflows, not npm install-time mutation.
Network hosts found are package-aligned model/GitHub/artifact endpoints, not hidden exfiltration endpoints.
Large web-shell/font/wasm assets are identifiable UI/runtime assets, not staged opaque install payloads.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 578 file(s), 37.5 MB of source, external domains: 127.0.0.1, 169.254.169.254, accounts.google.com, aiplatform.googleapis.com, api.anthropic.com, api.dingtalk.com, api.github.com, api.openai.com, api.sgroup.qq.com, api.telegram.org, bots.qq.com, bucket.example.com, cdn.example.com, cdn.jsdelivr.net, chat.qwen.ai, chevrotain.io, claudemarketplaces.com, cloud.google.com, cloudresourcemanager.googleapis.com, codeload.github.com, coding-intl.dashscope.aliyuncs.com, coding.dashscope.aliyuncs.com, crystal-lang.org, dashscope.aliyuncs.com, dev.w3.org, developer.mozilla.org, docs.anthropic.com, docs.expo.dev, docs.microsoft.com, docs.neo4j.org, dotenvx.com, dummy.com, empty.invalid, en.cppreference.com, en.wikipedia.org, example.com, fb.me, fburl.com, fetch.spec.whatwg.org, fishshell.com, geminicli.com, generativelanguage.googleapis.com, gist.githubusercontent.com, git.new, github.com, help.openai.com, host.docker.internal, ilinkai.weixin.qq.com, jimmy.warting.se, jquery.org

Oversized source lightweight scan

chunks/chunk-QNKBEJO2.js2.67 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringswww.apache.org

chunks/chunk-YAINVQ3Q.js5.11 MB file, sampled 256 KB

FilesystemNetworkChildProcessEvalCryptoHighEntropyStringsUrlStringsgithub.com

chunks/dist-LB6OGPVM.js4.69 MB file, sampled 256 KB

FilesystemNetworkChildProcessCryptoHighEntropyStringsUrlStringsopen.feishu.cn

Source & flagged code

18 flagged · loading source

chunks/tree-sitter-bash-VEJGF5XF.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

chunks/tree-sitter-bash-VEJGF5XF.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in chunks/tree-sitter-bash-VEJGF5XF.js

chunks/tree-sitter-bash-VEJGF5XF.jsView on unpkg · L8

chunks/chunk-RRFZXMYP.jsView file

219init_esbuild_shims(); L220: import { spawn } from "node:child_process"; L221: var CodePage = {

High

Child Process

Package source references child process execution.

chunks/chunk-RRFZXMYP.jsView on unpkg · L219

5363const ps = spawn2( L5364: "powershell.exe", L5365: [

High

Shell

Package source references shell execution.

chunks/chunk-RRFZXMYP.jsView on unpkg · L5363

43Cross-file remote execution chain: chunks/chunk-RRFZXMYP.js spawns chunks/chunk-M2U5NM24.js; helper contains network access plus dynamic code execution. L43: import { L44: require_undici L45: } from "./chunk-M2U5NM24.js"; ... L219: init_esbuild_shims(); L220: import { spawn } from "node:child_process"; L221: var CodePage = { ... L255: var copyToClipboard = /* @__PURE__ */ __name(async (text) => { L256: const run = /* @__PURE__ */ __name((cmd, args, options) => new Promise((resolve6, reject) => { L257: const child = options ? spawn(cmd, args, options) : spawn(cmd, args); L258: let stderr = ""; L259: if (child.stderr) { ... L273: child.stdin.on("error", reject);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

chunks/chunk-RRFZXMYP.jsView on unpkg · L43

43import { L44: require_undici L45: } from "./chunk-M2U5NM24.js"; ... L219: init_esbuild_shims(); L220: import { spawn } from "node:child_process"; L221: var CodePage = { ... L255: var copyToClipboard = /* @__PURE__ */ __name(async (text) => { L256: const run = /* @__PURE__ */ __name((cmd, args, options) => new Promise((resolve6, reject) => { L257: const child = options ? spawn(cmd, args, options) : spawn(cmd, args); L258: let stderr = ""; L259: if (child.stderr) { ... L273: child.stdin.on("error", reject);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

chunks/chunk-RRFZXMYP.jsView on unpkg · L43

chunks/chunk-N4EJFBN5.jsView file

273site.name = fn.name; L274: var deprecatedfn = new Function( L275: "fn",

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunks/chunk-N4EJFBN5.jsView on unpkg · L273

12import { L13: writeStderrLine L14: } from "./chunk-Y6Z2O3WR.js"; ... L41: module.exports = depd; L42: var basePath = process.cwd(); L43: function containsNamespace(str, namespace) { ... L120: } L121: var str = process.env.NO_DEPRECATION || ""; L122: return containsNamespace(str, namespace); ... L182: var output = format.call(this, msg, caller, stack.slice(i)); L183: process.stderr.write(output + "\n", "utf8"); L184: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunks/chunk-N4EJFBN5.jsView on unpkg · L12

chunks/chunk-R5OP2ATH.jsView file

158L159: // import("./locales/**/*.js") in packages/cli/src/i18n/index.ts L160: var globImport_locales_js = __glob({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

chunks/chunk-R5OP2ATH.jsView on unpkg · L158

chunks/workflow-LAWIW5LI.jsView file

278} L279: const envSec = Number(process.env["QWEN_CODE_MAX_WORKFLOW_SECONDS"]); L280: if (Number.isFinite(envSec) && envSec > 0) return envSec * 1e3; ... L427: // cannot reach host process. L428: globalThis.args = __b.argsJson === null ? undefined : JSON.parse(__b.argsJson); L429:

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

chunks/workflow-LAWIW5LI.jsView on unpkg · L278

web-shell/assets/index-w6GTOHh1.jsView file

48Error generating stack: `+r.message+` L49: `+r.stack}}var mx=Object.prototype.hasOwnProperty,p3=Br.unstable_scheduleCallback,Db=Br.unstable_cancelCallback,m$=Br.unstable_shouldYield,p$=Br.unstable_requestPaint,mi=Br.unstabl... L50: `).replace(sP,"")}function LM(e,t){return t=X8(t),X8(e)===t}function En(e,t,n,r,s,i){switch(n){case"children":typeof r=="string"?t==="body"||t==="textarea"&&r===""||Vd(e,r):(typeof... ... L60: `);if(s!==-1){let i=n+s;t.push(e.slice(n,i)),n=i+4}else t.push(e.slice(n,r)),n=r+2}return{frames:t,tail:e.slice(n)}}function m2(e){if(!e)return;let t=[];for(let r of e.split(/\r?\n... L61: `);try{let r=JSON.parse(n);if(typeof r!="object"||r===null||Array.isArray(r)||r.v!==1||typeof r.type!="string")return;let s=r.id;return s!==void 0&&(!Number.isSafeInteger(s)||s<1)?.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

web-shell/assets/index-w6GTOHh1.jsView on unpkg · L48

chunks/chunk-YAINVQ3Q.jsView file

•context = stemPayload: {\n snapshots: remappedSnapshots.map(serializeSnapshot)\n }\n };\n forked.push(snapshotRecord);\n }\n fs7.mkdirSync(chatsDir, { recursive: true });\n const body2 = forked.map((r) => JSON.stringify(r)).join("\n") + "\n";\n let fd;\n try {\n fd = fs7.openSync(targetPath, "wx", 384);\n } catch (err2) {\n if (err2.code === "EEXIST") {\n throw new Error(`Target session file already exists: ${newSessionId}`);\n }\n throw err2;\n }\n try {\n fs7.writeFileSync(fd, body2, { encoding: "utf8" });\n } finally {\n fs7.closeSync(fd);\n }\n await copyFileHistoryBackups(sourceSessionId, newSessionId);\n return { filePath: targetPath, copiedCount: forked.length };\n }\n /**\n * Gets

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

chunks/chunk-YAINVQ3Q.jsView on unpkg

chunks/chunk-FKAVULLM.jsView file

1111}, L1112: baseUrl: { L1113: type: "string", ... L1822: default: true, L1823: description: "Use node-pty for an interactive shell experience. Falls back to child_process if PTY is unavailable.", L1824: showInDialog: true ... L2852: try { L2853: const content = fs.readFileSync(filePath, "utf-8"); L2854: return parseOutputLanguageFromContent(content);

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

chunks/chunk-FKAVULLM.jsView on unpkg · L1111

vendor/ripgrep/x64-darwin/rgView file

•path = vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/ripgrep/x64-darwin/rgView on unpkg

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg

web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

chunks/dist-LB6OGPVM.jsView file

•path = chunks/dist-LB6OGPVM.js kind = oversized_source_file sizeBytes = 4920964 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

chunks/dist-LB6OGPVM.jsView on unpkg

package.jsonView file

•dependencies registry_only=@qwen-code/audio-capture

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg