qwenproxy-cli@1.0.2
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package is not shown to be malicious, but it has an explicit command that changes multiple AI-agent control surfaces and a CLI-triggered runtime installer. The changes are user-invoked and backed up, so blocking publication is not warranted.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs qwenproxy sync or starts the CLI without an installed Patchright Chromium runtime.
Impact
Client model routing can be changed to QwenProxy; this is a meaningful capability but is not automatically triggered at npm install time.
Mechanism
User-invoked agent configuration rewrite and browser-runtime installation.
AI rationale
This package is not shown to be malicious, but it has an explicit command that changes multiple AI-agent control surfaces and a CLI-triggered runtime installer. The changes are user-invoked and backed up, so blocking publication is not warranted.
Evidence
src/sync-clients.tssrc/sync/index.tssrc/sync/codex.tsbin/qwenproxy.js~/.claude/settings.json~/.codex/config.toml~/.config/opencode/opencode.jsonc~/.omp/agent/models.yml
Network endpoints2
chat.qwen.ai127.0.0.1
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit sync command invokes a routine that rewrites detected AI-client configuration files.
- The sync routine targets Claude Code, Codex, OpenCode, and OMP configuration locations and enables QwenProxy as Codex's active provider by default.
- The CLI also downloads a Chromium runtime through npx when it is missing.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The agent configuration changes require the user to run the sync command and create backups before modifying existing files.
- No source evidence shows credential exfiltration, remote payload execution, or a runtime dependency on this package itself.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbin/qwenproxy.jsView file
17L18: import { spawn, spawnSync } from "node:child_process";
L19: import path from "node:path";
High
125stdio: "inherit",
L126: shell: true,
L127: });
High
119package = qwenproxy-cli; repositoryIdentity = qwenproxy; dependency = patchright
L119: try {
L120: const { chromium } = await import("patchright");
L121: const execPath = chromium.executablePath();
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
bin/qwenproxy.jsView on unpkg · L119123console.log("⏳ [QwenProxy] Instalando o navegador Chromium pela primeira vez...");
L124: spawnSync("npx", ["patchright", "install", "chromium"], {
L125: stdio: "inherit",
Findings
4 High3 Medium5 Low
HighChild Processbin/qwenproxy.js
HighShellbin/qwenproxy.js
HighCopied Package Dependency Bridgebin/qwenproxy.js
HighRuntime Package Installbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.0.2.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.