qwenproxy-cli@1.2.1
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a guarded, explicit-user-command AI-client configuration capability rather than malware. It warrants a warning because it can change multiple agent configurations and defaults to detected clients, but static inspection found no install-time trigger or confirmed malicious attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the qpx sync command or the sync script.
Impact
It can change the active provider for detected AI clients after the user invokes synchronization; no confirmed covert exfiltration or lifecycle-triggered mutation was found.
Mechanism
The synchronizer selects client configuration paths, creates backups where applicable, and writes provider settings that point at the configured local gateway.
AI rationale
This is a guarded, explicit-user-command AI-client configuration capability rather than malware. It warrants a warning because it can change multiple agent configurations and defaults to detected clients, but static inspection found no install-time trigger or confirmed malicious attack.
Evidence
src/sync/index.tssrc/sync/codex.tssrc/sync-clients.tsbin/qwenproxy.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest exposes a command-line entry point and has no install lifecycle hook.
- The command-line launcher enters the synchronization program only when the user supplies the sync command.
- The synchronization command invokes client synchronization, defaulting to all detected clients when none are selected.
- Synchronization targets existing AI-client configuration locations, including Codex configuration.
- The Codex synchronizer adds a QwenProxy provider, local base URL, and bearer-token setting to that configuration.
- The updater is an explicit command function, not an install-time hook.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
src/core/accounts.tsView file
22function parseEnvAccounts(): QwenAccount[] {
L23: const envAccounts = process.env.QWEN_ACCOUNTS;
L24: if (!envAccounts) return [];
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/accounts.tsView on unpkg · L22Findings
5 High3 Medium5 Low
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighPrevious Version Dangerous Deltabin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.2.1.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.