qwenproxy-cli@1.0.3
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo lifecycle hook, self-dependency, credential exfiltration, or hidden install-time mutation was found. The package nevertheless has an explicit command that changes multiple AI-client control configurations and can activate its provider.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs qwenproxy sync or npm run sync.
Impact
It can change the active Codex provider and redirect supported client traffic to the local proxy.
Mechanism
Explicit AI-client configuration rewrite and local proxy routing.
AI rationale
No lifecycle hook, self-dependency, credential exfiltration, or hidden install-time mutation was found. The package nevertheless has an explicit command that changes multiple AI-client control configurations and can activate its provider.
Evidence
bin/qwenproxy.jssrc/sync/index.tssrc/sync/codex.ts~/.claude/settings.json~/.codex/config.toml~/.config/opencode/opencode.jsonc~/.omp/agent/models.yml
Network endpoints2
127.0.0.1:7936chat.qwen.ai
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit sync command modifies configuration for Codex, Claude Code, OpenCode, and OMP.
- Codex sync adds a QwenProxy provider, bearer token, and can set it as the active model.
- Normal CLI launch can invoke npx to install Chromium with shell execution.
Evidence against
- package.json contains no preinstall, install, or postinstall hook.
- The configuration mutation is reached only through the user-invoked sync command.
- The configured proxy endpoint is localhost; upstream Qwen access is consistent with the proxy function.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbin/qwenproxy.jsView file
17L18: import { spawn, spawnSync } from "node:child_process";
L19: import path from "node:path";
High
125stdio: "inherit",
L126: shell: true,
L127: });
High
119package = qwenproxy-cli; repositoryIdentity = qwenproxy; dependency = patchright
L119: try {
L120: const { chromium } = await import("patchright");
L121: const execPath = chromium.executablePath();
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
bin/qwenproxy.jsView on unpkg · L119123console.log("⏳ [QwenProxy] Instalando o navegador Chromium pela primeira vez...");
L124: spawnSync("npx", ["patchright", "install", "chromium"], {
L125: stdio: "inherit",
Findings
4 High3 Medium5 Low
HighChild Processbin/qwenproxy.js
HighShellbin/qwenproxy.js
HighCopied Package Dependency Bridgebin/qwenproxy.js
HighRuntime Package Installbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.0.3.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.