registry / qwenproxy-cli / 1.2.2
qwenproxy-cli@1.2.2
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInstall metadata has no lifecycle hooks, and agent config changes happen only when the user runs sync to point local clients at this proxy. The update path is an explicit command that installs the same published package from the npm registry.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No automatic trigger. Sync and update run only after the user invokes those CLI commands.
Impact
No unconsented agent-control mutation, credential export, or remote payload execution was identified.
Mechanism
The CLI dispatches to local TypeScript entrypoints. Sync rewrites detected local client settings to a localhost base URL; update queries the npm registry for this package and installs it with the detected package manager.
AI rationale
Install metadata has no lifecycle hooks, and agent config changes happen only when the user runs sync to point local clients at this proxy. The update path is an explicit command that installs the same published package from the npm registry.
Network endpoints3
registry.npmjs.orgcdn.playwright.devchat.qwen.ai
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hooks; scripts are user-run start, tui, login, and sync commands.
- bin/qwenproxy.js loads client sync only when the first argument is sync; the default path is the local TUI or server.
- src/sync/index.ts maps detected clients to local home config paths such as ~/.claude/settings.json and only rewrites them from the explicit sync command so they point at the local proxy.
- bin/update.js runs only from the update command and installs this same package name from the public npm registry.
Evidence against
- The explicit sync command rewrites several third-party AI client config files in the user home directory and keeps backups for restore.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
src/core/accounts.tsView file
22function parseEnvAccounts(): QwenAccount[] {
L23: const envAccounts = process.env.QWEN_ACCOUNTS;
L24: if (!envAccounts) return [];
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/accounts.tsView on unpkg · L22Findings
5 High3 Medium5 Low
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighPrevious Version Dangerous Deltabin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.2.2.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.