qwenproxy-cli@1.2.10
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiAgent-config writes are real but only after an explicit sync command, not an install hook, and they point clients at the local proxy with backups. That is a guarded explicit-command capability, so the package should be warned rather than blocked.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs qpx sync, npm run sync, or confirms sync in the TUI.
Impact
Those local tools then send traffic and the proxy key through the configured local gateway. Prior files are backed up. No install-time control-surface write or remote credential export was found.
Mechanism
syncAllClients resolves home-directory agent configs and syncClaudeCode writes Anthropic base URL, auth token, and model fields, with the same pattern for the other clients.
AI rationale
Agent-config writes are real but only after an explicit sync command, not an install hook, and they point clients at the local proxy with backups. That is a guarded explicit-command capability, so the package should be warned rather than blocked.
Evidence
src/sync/index.tssrc/sync/claude-code.tsbin/qwenproxy.jssrc/sync-clients.ts.claude/settings.json.codex/config.toml.openclaw/openclaw.json.hermes/config.yaml.aider.conf.yml
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with high false-positive risk.
Evidence for warning
- package.json exposes only user scripts such as start, tui, login, and sync, with no preinstall, install, or postinstall hook.
- Default sync paths include foreign agent homes such as ~/.claude/settings.json and Codex config.toml.
- The qpx sync command is an explicit CLI branch that launches src/sync-clients.ts.
- With no target list, syncAllClients selects every supported client.
- Claude Code sync writes ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN into that settings file.
- Self-update runs only from the update command and queries the npm registry for this package name.
Evidence against
- Nothing runs these writers on npm install or on import of the library entry.
- Sync creates timestamp backups and a restore path.
- Base URLs are built for the local proxy host, and media fetches reject private and metadata hosts.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
src/core/accounts.tsView file
25function parseEnvAccounts(): QwenAccount[] {
L26: const envAccounts = process.env.QWEN_ACCOUNTS;
L27: if (!envAccounts) return [];
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/accounts.tsView on unpkg · L25Findings
6 High3 Medium5 Low
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accesssrc/core/safe-remote-url.ts
HighPrevious Version Dangerous Deltabin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.2.10.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.2.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.