@qwen-code/qwen-code@0.19.4: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@qwen-code/qwen-code@0.19.4: Clean npm security report (Allow) | LPM Firewall

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json defines postinstall: node postinstall.js
postinstall.js uses spawnSync to run patch-package when chrome-devtools-mcp is present
patches/chrome-devtools-mcp+1.4.0.patch modifies node_modules/chrome-devtools-mcp/build/src/McpContext.js at install time

Evidence against

postinstall.js only resolves chrome-devtools-mcp/package.json and applies bundled patches; no network, credential reads, or home/project agent config writes observed
cli-entry.js only re-execs local cli.js with --expose-gc or imports it for serve command
cli.js imports local bundled chunks and starts the Qwen CLI; no import-time exfiltration observed
Network hosts found are package-aligned AI/API/docs endpoints such as dashscope.aliyuncs.com, api.openai.com, chat.qwen.ai, and local serve URLs
Extension/skills content is under package-owned bundled/ and examples/ namespaces, not lifecycle-planted into foreign agent control surfaces
Critical secret hint appears to match bundled/generated parser or binary-like data, not a usable credential

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 598 file(s), 38.4 MB of source, external domains: 127.0.0.1, 169.254.169.254, accounts.google.com, aiplatform.googleapis.com, api.anthropic.com, api.dingtalk.com, api.github.com, api.openai.com, api.sgroup.qq.com, api.telegram.org, bots.qq.com, bucket.example.com, cdn.example.com, cdn.jsdelivr.net, chat.qwen.ai, chevrotain.io, claudemarketplaces.com, cloud.google.com, cloudresourcemanager.googleapis.com, codeload.github.com, coding-intl.dashscope.aliyuncs.com, coding.dashscope.aliyuncs.com, crystal-lang.org, dashscope.aliyuncs.com, dev.w3.org, developer.mozilla.org, docs.anthropic.com, docs.expo.dev, docs.microsoft.com, docs.neo4j.org, dotenvx.com, dummy.com, empty.invalid, en.cppreference.com, en.wikipedia.org, example.com, fb.me, fburl.com, fetch.spec.whatwg.org, fishshell.com, geminicli.com, generativelanguage.googleapis.com, gist.githubusercontent.com, git.new, github.com, help.openai.com, host.docker.internal, ilinkai.weixin.qq.com, jimmy.warting.se, jquery.org

Oversized source lightweight scan

chunks/chunk-BFG6OZN7.js5.20 MB file, sampled 256 KB

FilesystemNetworkChildProcessEvalCryptoHighEntropyStringsUrlStringsgithub.com

chunks/chunk-HJDF3ZVU.js2.73 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringswww.apache.org

chunks/dist-XBOVZ3R5.js4.69 MB file, sampled 256 KB

FilesystemNetworkChildProcessCryptoHighEntropyStringsUrlStringsopen.feishu.cn

Source & flagged code

15 flagged · loading source

package.jsonView file

•dependencies registry_only=@qwen-code/audio-capture

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

chunks/tree-sitter-bash-VEJGF5XF.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

chunks/tree-sitter-bash-VEJGF5XF.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in chunks/tree-sitter-bash-VEJGF5XF.js

chunks/tree-sitter-bash-VEJGF5XF.jsView on unpkg · L8

postinstall.jsView file

1#!/usr/bin/env node L2: import { spawnSync } from 'node:child_process'; L3: import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L1

chunks/chunk-22IFUCVR.jsView file

111case "win32": L112: command = "powershell.exe"; L113: args = [

High

Shell

Package source references shell execution.

chunks/chunk-22IFUCVR.jsView on unpkg · L111

chunks/chunk-NPQWQYU6.jsView file

70const moduleName = "keytar"; L71: const module = await import(moduleName); L72: this.keytarModule = module.default || module;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

chunks/chunk-NPQWQYU6.jsView on unpkg · L70

web-shell/assets/index-BpKnmyFV.jsView file

48Error generating stack: `+r.message+` L49: `+r.stack}}var lw=Object.prototype.hasOwnProperty,u3=$r.unstable_scheduleCallback,Nb=$r.unstable_cancelCallback,jP=$r.unstable_shouldYield,LP=$r.unstable_requestPaint,_i=$r.unstabl... L50: `).replace(k$,"")}function VM(e,t){return t=Zk(t),Zk(e)===t}function Mn(e,t,n,r,s,i){switch(n){case"children":typeof r=="string"?t==="body"||t==="textarea"&&r===""||Vd(e,r):(typeof... ... L60: `);if(s!==-1){let i=n+s;t.push(e.slice(n,i)),n=i+4}else t.push(e.slice(n,r)),n=r+2}return{frames:t,tail:e.slice(n)}}function c2(e){if(!e)return;let t=[];for(let r of e.split(/\r?\n... L61: `);try{let r=JSON.parse(n);if(typeof r!="object"||r===null||Array.isArray(r)||r.v!==1||typeof r.type!="string")return;let s=r.id;return s!==void 0&&(!Number.isSafeInteger(s)||s<1)?.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

web-shell/assets/index-BpKnmyFV.jsView on unpkg · L48

chunks/chunk-BFG6OZN7.jsView file

•context = emPayload: {\n snapshots: remappedSnapshots.map(serializeSnapshot)\n }\n };\n forked.push(snapshotRecord);\n }\n fs7.mkdirSync(chatsDir, { recursive: true });\n const body2 = forked.map((r2) => JSON.stringify(r2)).join("\n") + "\n";\n let fd;\n try {\n fd = fs7.openSync(targetPath, "wx", 384);\n } catch (err2) {\n if (err2.code === "EEXIST") {\n throw new Error(`Target session file already exists: ${newSessionId}`);\n }\n throw err2;\n }\n try {\n fs7.writeFileSync(fd, body2, { encoding: "utf8" });\n } finally {\n fs7.closeSync(fd);\n }\n await copyFileHistoryBackups(sourceSessionId, newSessionId);\n return { filePath: targetPath, copiedCount: forked.length };\n }\n /**\n * Gets

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

chunks/chunk-BFG6OZN7.jsView on unpkg

•path = chunks/chunk-BFG6OZN7.js kind = oversized_source_file sizeBytes = 5451144 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

chunks/chunk-BFG6OZN7.jsView on unpkg

chunks/chunk-ZXCVPMIK.jsView file

43Cross-file remote execution chain: chunks/chunk-ZXCVPMIK.js spawns chunks/chunk-4VZH35PN.js; helper contains network access plus dynamic code execution. L43: import { L44: require_undici L45: } from "./chunk-54YZOP7P.js"; ... L231: init_esbuild_shims(); L232: import { spawn } from "node:child_process"; L233: var CodePage = { ... L269: const child = options ? spawn(cmd, args, options) : spawn(cmd, args); L270: let stderr = ""; L271: if (child.stderr) { ... L285: child.stdin.on("error", reject); L286: child.stdin.write(text); L287: child.stdin.end();

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

chunks/chunk-ZXCVPMIK.jsView on unpkg · L43

vendor/ripgrep/x64-darwin/rgView file

•path = vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/ripgrep/x64-darwin/rgView on unpkg

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg

web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg