qwenproxy-cli@1.0.4
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an explicit-user-command AI-agent configuration mutator with shell-based runtime installs, so it warrants a warning. Static inspection found no automatic lifecycle hook or concrete malicious payload.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs qwenproxy sync, or starts the CLI without an installed Patchright Chromium binary.
Impact
The sync operation can redirect supported AI clients to QwenProxy and set Codex's active provider; browser installation downloads executable browser assets.
Mechanism
Agent configuration rewriting and shell-based dependency installation.
AI rationale
This is an explicit-user-command AI-agent configuration mutator with shell-based runtime installs, so it warrants a warning. Static inspection found no automatic lifecycle hook or concrete malicious payload.
Evidence
bin/qwenproxy.jssrc/sync/index.tssrc/sync/codex.tssrc/update-cli.ts~/.claude/settings.json~/.codex/config.toml~/.config/opencode/opencode.jsonc~/.omp/agent/models.yml
Network endpoints2
127.0.0.1chat.qwen.ai
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit sync command can create or rewrite Claude Code, Codex, OpenCode, and OMP configuration files.
- Syncing Codex inserts a QwenProxy provider, bearer token, and makes it the active model by default.
- Every CLI launch may invoke npx through a shell to install Chromium if it is absent.
- The explicit update command queries npm and runs a global package-manager update through a shell.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The agent configuration changes are reachable through the separately named sync command, which offers restore and target-selection options.
- The observed network use is for the Qwen proxy service or an explicitly requested update; no secret collection or unrelated exfiltration path was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flaggedbin/qwenproxy.jsView file
17L18: import { spawn, spawnSync } from "node:child_process";
L19: import path from "node:path";
High
125stdio: "inherit",
L126: shell: true,
L127: });
High
119package = qwenproxy-cli; repositoryIdentity = qwenproxy; dependency = patchright
L119: try {
L120: const { chromium } = await import("patchright");
L121: const execPath = chromium.executablePath();
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
bin/qwenproxy.jsView on unpkg · L119123console.log("⏳ [QwenProxy] Instalando o navegador Chromium pela primeira vez...");
L124: spawnSync("npx", ["patchright", "install", "chromium"], {
L125: stdio: "inherit",
Findings
4 High3 Medium5 Low
HighChild Processbin/qwenproxy.js
HighShellbin/qwenproxy.js
HighCopied Package Dependency Bridgebin/qwenproxy.js
HighRuntime Package Installbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.0.4.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.