registry / qwenproxy-cli / 1.0.25
qwenproxy-cli@1.0.25
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInstall metadata has no lifecycle hook, and the default CLI starts a local proxy rather than mutating agent configs. Sync writes to Claude, Codex, OpenCode, and OMP only after an explicit user command and points them at the local gateway.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No automatic trigger. Agent files change only when the user runs qpx sync or confirms sync in the TUI.
Impact
No unconsented credential export, remote payload, persistence, or foreign control-surface mutation was established.
Mechanism
The CLI dispatches to local TypeScript entrypoints. Sync rewrites selected client configs to a loopback proxy URL and keeps a backup; clipboard and Playwright actions stay on the machine.
AI rationale
Install metadata has no lifecycle hook, and the default CLI starts a local proxy rather than mutating agent configs. Sync writes to Claude, Codex, OpenCode, and OMP only after an explicit user command and points them at the local gateway.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes bin qpx and npm scripts only; there is no preinstall, install, or postinstall hook.
- src/sync/index.ts names Claude Code, Codex, OpenCode, and OMP config paths, and those writes run only from the explicit sync command or a TUI Enter action.
- bin/qwenproxy.js routes the sync subcommand to src/sync-clients.ts; the default path starts the local proxy or TUI.
- src/tui/theme.ts clipboard helpers call local OS utilities and are used for in-TUI paste, not a network send.
Evidence against
- Explicit qpx sync and the TUI sync view rewrite user agent config files after a backup, which matches the stated local gateway product.
- Browser commands may download Chromium from the Playwright CDN or a regional mirror, and qpx update can install a newer release of this package when the user runs it.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flaggedbin/qwenproxy.jsView file
17L18: import { spawn, spawnSync } from "node:child_process";
L19: import path from "node:path";
High
150const cmd = process.platform === "win32" ? "npx.cmd" : "npx";
L151: return spawnSync(cmd, ["--yes", "patchright", "install", "chromium"], {
L152: stdio: "inherit",
...
L156:
L157: let chosenHost = process.env.PLAYWRIGHT_DOWNLOAD_HOST;
L158: if (!chosenHost) {
...
L162: try {
L163: const probe = await fetch("https://cdn.playwright.dev", { method: "HEAD", signal: controller.signal });
L164: clearTimeout(probeTimer);
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/qwenproxy.jsView on unpkg · L15015*/
L16: process.env.DOTENV_CONFIG_QUIET = "true";
L17:
L18: import { spawn, spawnSync } from "node:child_process";
L19: import path from "node:path";
...
L24: const require = createRequire(import.meta.url);
L25: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L26: const packageRoot = path.resolve(__dirname, "..");
L27: const packageJsonPath = path.join(packageRoot, "package.json");
L28:
...
L34: try {
L35: const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
Findings
5 High3 Medium5 Low
HighChild Processbin/qwenproxy.js
HighShellsrc/tui/theme.ts
HighSame File Env Network Executionbin/qwenproxy.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighPrevious Version Dangerous Deltabin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.0.25.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.0.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.