@qwen-code/qwen-code@0.19.6: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@qwen-code/qwen-code@0.19.6: Clean npm security report (Allow) | LPM Firewall

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

CLI includes user-invoked extension/MCP management that can read/write Qwen settings and import Claude MCP config.
Standalone updater code can download release archives and modify PATH wrappers when explicitly run.

Evidence against

package.json has no npm lifecycle scripts; install/import does not auto-run setup hooks.
cli-entry.js only dispatches CLI commands or respawns cli.js with --expose-gc.
Claude/MCP config access in chunks/chunk-O2RJARYU.js is import-only and user-invoked, writing Qwen mcpServers via settings.setValue.
Extension install in chunks/chunk-DXXNMPJH.js requires explicit qwen extensions install/link/new commands and consent handling.
Network endpoints are package-aligned AI/update services such as DashScope, OpenAI-compatible APIs, Google Gemini, Qwen release assets, and GitHub releases.
tree-sitter bash blob and .woff2 assets are parser/font payloads, not staged executable malware.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 607 file(s), 38.6 MB of source, external domains: 127.0.0.1, 169.254.169.254, accounts.google.com, aiplatform.googleapis.com, api.anthropic.com, api.dingtalk.com, api.github.com, api.openai.com, api.sgroup.qq.com, api.telegram.org, bots.qq.com, bucket.example.com, cdn.example.com, cdn.jsdelivr.net, chat.qwen.ai, chevrotain.io, claudemarketplaces.com, cloud.google.com, cloudresourcemanager.googleapis.com, codeload.github.com, coding-intl.dashscope.aliyuncs.com, coding.dashscope.aliyuncs.com, crystal-lang.org, dashscope.aliyuncs.com, dev.w3.org, developer.mozilla.org, docs.anthropic.com, docs.expo.dev, docs.microsoft.com, docs.neo4j.org, dotenvx.com, dummy.com, empty.invalid, en.cppreference.com, en.wikipedia.org, example.com, fb.me, fburl.com, fetch.spec.whatwg.org, fishshell.com, geminicli.com, generativelanguage.googleapis.com, gist.githubusercontent.com, git.new, github.com, help.openai.com, host.docker.internal, ilinkai.weixin.qq.com, jimmy.warting.se, jquery.org

Oversized source lightweight scan

chunks/chunk-AGZF43UV.js5.25 MB file, sampled 256 KB

FilesystemNetworkChildProcessEvalCryptoHighEntropyStringsUrlStringsgithub.com

chunks/chunk-JN2VJ33O.js2.73 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringswww.apache.org

chunks/dist-JPSVN367.js4.70 MB file, sampled 256 KB

FilesystemNetworkChildProcessCryptoHighEntropyStringsUrlStringsopen.feishu.cn

Source & flagged code

15 flagged · loading source

chunks/tree-sitter-bash-VEJGF5XF.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

chunks/tree-sitter-bash-VEJGF5XF.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in chunks/tree-sitter-bash-VEJGF5XF.js

chunks/tree-sitter-bash-VEJGF5XF.jsView on unpkg · L8

chunks/chunk-HTWHAN44.jsView file

3027init_esbuild_shims(); L3028: import { execSync } from "node:child_process"; L3029: import process from "node:process";

High

Child Process

Package source references child process execution.

chunks/chunk-HTWHAN44.jsView on unpkg · L3027

chunks/chunk-22IFUCVR.jsView file

111case "win32": L112: command = "powershell.exe"; L113: args = [

High

Shell

Package source references shell execution.

chunks/chunk-22IFUCVR.jsView on unpkg · L111

chunks/chunk-NPQWQYU6.jsView file

70const moduleName = "keytar"; L71: const module = await import(moduleName); L72: this.keytarModule = module.default || module;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

chunks/chunk-NPQWQYU6.jsView on unpkg · L70

chunks/artifact-tool-SLYPWG3C.jsView file

66if (extResource) { L67: return `Artifact must be self-contained \u2014 found an external reference (${truncate(extResource[0])}). Inline scripts/styles and embed assets as data: URIs.`; L68: } ... L72: } L73: const extScript = /\b(?:fetch|WebSocket|XMLHttpRequest)\s*\(\s*["']\s*(?:https?|wss?):\/\//i.exec( L74: scan ... L168: init_esbuild_shims(); L169: import { execFile } from "node:child_process"; L170: import { promisify } from "node:util"; ... L321: }, "defaultHttpPut"); L322: function ossCredentialsFromEnv(env = process.env) { L323: const accessKeyId = env["OSS_ACCESS_KEY_ID"] || env["ALIBABA_CLOUD_ACCESS_KEY_ID"];

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunks/artifact-tool-SLYPWG3C.jsView on unpkg · L66

web-shell/assets/index-DCHPAUp3.jsView file

48Error generating stack: `+r.message+` L49: `+r.stack}}var Vv=Object.prototype.hasOwnProperty,Z3=rs.unstable_scheduleCallback,a2=rs.unstable_cancelCallback,tz=rs.unstable_shouldYield,nz=rs.unstable_requestPaint,Oi=rs.unstabl... L50: `).replace(VF,"")}function YI(e,t){return t=K8(t),K8(e)===t}function Un(e,t,n,r,s,i){switch(n){case"children":typeof r=="string"?t==="body"||t==="textarea"&&r===""||ah(e,r):(typeof... ... L60: `);if(s!==-1){let i=n+s;t.push(e.slice(n,i)),n=i+4}else t.push(e.slice(n,r)),n=r+2}return{frames:t,tail:e.slice(n)}}function z2(e){if(!e)return;let t=[];for(let r of e.split(/\r?\n... L61: `);try{let r=JSON.parse(n);if(typeof r!="object"||r===null||Array.isArray(r)||r.v!==1||typeof r.type!="string")return;let s=r.id;return s!==void 0&&(!Number.isSafeInteger(s)||s<1)?.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

web-shell/assets/index-DCHPAUp3.jsView on unpkg · L48

chunks/chunk-AGZF43UV.jsView file

•context = emPayload: {\n snapshots: remappedSnapshots.map(serializeSnapshot)\n }\n };\n forked.push(snapshotRecord);\n }\n fs7.mkdirSync(chatsDir, { recursive: true });\n const body2 = forked.map((r2) => JSON.stringify(r2)).join("\n") + "\n";\n let fd;\n try {\n fd = fs7.openSync(targetPath, "wx", 384);\n } catch (err2) {\n if (err2.code === "EEXIST") {\n throw new Error(`Target session file already exists: ${newSessionId}`);\n }\n throw err2;\n }\n try {\n fs7.writeFileSync(fd, body2, { encoding: "utf8" });\n } finally {\n fs7.closeSync(fd);\n }\n await copyFileHistoryBackups(sourceSessionId, newSessionId);\n return { filePath: targetPath, copiedCount: forked.length };\n }\n /**\n * Gets

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

chunks/chunk-AGZF43UV.jsView on unpkg

•path = chunks/chunk-AGZF43UV.js kind = oversized_source_file sizeBytes = 5506545 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

chunks/chunk-AGZF43UV.jsView on unpkg

chunks/chunk-QOKV6AO4.jsView file

116isValidEditorType, L117: resolveBaseUrl, L118: resolveMetadataKey, ... L7048: import path from "node:path"; L7049: import { spawn, spawnSync } from "node:child_process"; L7050: var CACHE_LIMIT = 40; ... L12520: const currentText = stateRef.current.lines.join("\n"); L12521: fs2.writeFileSync(filePath, currentText, { L12522: encoding: "utf8",

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

chunks/chunk-QOKV6AO4.jsView on unpkg · L116

1820Cross-file remote execution chain: chunks/chunk-QOKV6AO4.js spawns chunks/chunk-YSU33ACT.js; helper contains network access plus dynamic code execution. L1820: var err = new Error( L1821: "Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types" L1822: ); ... L1931: } L1932: if (process.platform === "win32") { L1933: const osRelease = os3.release().split("."); ... L1978: supportsColor: getSupportLevel, L1979: stdout: translateLevel(supportsColor(true, tty.isatty(1))), L1980: stderr: translateLevel(supportsColor(true, tty.isatty(2))) ... L4836: function wrapAnsi(string, columns, options) { L4837: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((l

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

chunks/chunk-QOKV6AO4.jsView on unpkg · L1820

vendor/ripgrep/x64-darwin/rgView file

•path = vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/ripgrep/x64-darwin/rgView on unpkg

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg

web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

package.jsonView file

•dependencies registry_only=@qwen-code/audio-capture

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg