registry / qwenproxy-cli / 1.0.31
qwenproxy-cli@1.0.31
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a local Qwen API gateway whose agent-config edits happen only when the user runs sync or confirms it in the TUI, and package.json has no install lifecycle hooks. Clipboard, browser install, and npm update behavior stay on those user commands and on package-aligned hosts.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs qpx, qpx sync, or confirms sync in the TUI.
Impact
No unsolicited credential theft, remote payload, or agent-config takeover was identified.
Mechanism
The CLI starts a local Qwen-compatible proxy and, on an explicit sync action, points selected coding clients at 127.0.0.1.
AI rationale
This is a local Qwen API gateway whose agent-config edits happen only when the user runs sync or confirms it in the TUI, and package.json has no install lifecycle hooks. Clipboard, browser install, and npm update behavior stay on those user commands and on package-aligned hosts.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json scripts are start, tui, login, sync, clean, reset, purge, and tests only. There is no preinstall, install, or postinstall hook and no dependency on qwenproxy-cli itself.
- src/sync/index.ts only records local client config paths such as ~/.claude/settings.json. Those files are rewritten by syncAllClients, which is reached from the explicit qpx sync command or the TUI sync screen after Enter.
- bin/qwenproxy.js routes the sync argument to src/sync-clients.ts and otherwise launches the local server or TUI. Chromium download runs only for start, tui, or login and uses Playwright or the npmmirror fallback.
- src/tui/theme.ts setClipboardText copies text the user selects into the terminal or the local OS clipboard utilities. It does not send that text over the network.
Evidence against
- Explicit sync writes API base URLs and a local proxy key into third-party coding-client config files, with backups and a restore path.
- Upstream Qwen requests use the operator QWEN_BASE_URL, which defaults to https://chat.qwen.ai, and session cookies stay on that Qwen client path.
Behavioral surface
Source & flagged code
6 flaggedbin/qwenproxy.jsView file
17L18: import { spawn, spawnSync } from "node:child_process";
L19: import path from "node:path";
High
150const cmd = process.platform === "win32" ? "npx.cmd" : "npx";
L151: return spawnSync(cmd, ["--yes", "patchright", "install", "chromium"], {
L152: stdio: "inherit",
...
L156:
L157: let chosenHost = process.env.PLAYWRIGHT_DOWNLOAD_HOST;
L158: if (!chosenHost) {
...
L162: try {
L163: const probe = await fetch("https://cdn.playwright.dev", { method: "HEAD", signal: controller.signal });
L164: clearTimeout(probeTimer);
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/qwenproxy.jsView on unpkg · L15015*/
L16: process.env.DOTENV_CONFIG_QUIET = "true";
L17:
L18: import { spawn, spawnSync } from "node:child_process";
L19: import path from "node:path";
...
L24: const require = createRequire(import.meta.url);
L25: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L26: const packageRoot = path.resolve(__dirname, "..");
L27: const packageJsonPath = path.join(packageRoot, "package.json");
L28:
...
L34: try {
L35: const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
Findings
5 High3 Medium5 Low
HighChild Processbin/qwenproxy.js
HighShellsrc/tui/theme.ts
HighSame File Env Network Executionbin/qwenproxy.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighPrevious Version Dangerous Deltabin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.0.31.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.0.31 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.