registry / qwenproxy-cli / 1.2.3
qwenproxy-cli@1.2.3
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiLifecycle hooks are absent, and the flagged agent paths are used only by the documented sync command to point local clients at this proxy. The updater and browser installer are likewise user-started and package-aligned, so no concrete attack surface remains.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No automatic trigger. Sync and update run only when the user invokes those CLI commands or confirms sync in the TUI.
Impact
No unconsented control-surface mutation, credential export, or remote payload execution was established.
Mechanism
The package exposes a local OpenAI and Anthropic compatible gateway and, on request, points installed coding clients at 127.0.0.1.
AI rationale
Lifecycle hooks are absent, and the flagged agent paths are used only by the documented sync command to point local clients at this proxy. The updater and browser installer are likewise user-started and package-aligned, so no concrete attack surface remains.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json scripts are start, tui, login, and sync only; there is no preinstall, install, or postinstall hook.
- src/sync/index.ts only names local agent config paths such as ~/.claude/settings.json; writes happen inside syncAllClients, which is called from the explicit sync command or the TUI Enter action.
- bin/qwenproxy.js loads the sync script only when the first argument is sync, and loads the updater only when the first argument is update.
- bin/update.js runUpdateCommand reads this package name and asks the npm registry for a newer release only after the user runs the update command.
Evidence against
- qpx sync and the TUI sync view rewrite several third-party coding-agent config files so they point at the local proxy, with backups and a restore path.
- The updater and first-run browser setup spawn package managers and may download Chromium from the Playwright CDN or an npmmirror fallback.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
src/core/accounts.tsView file
22function parseEnvAccounts(): QwenAccount[] {
L23: const envAccounts = process.env.QWEN_ACCOUNTS;
L24: if (!envAccounts) return [];
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/accounts.tsView on unpkg · L22Findings
5 High3 Medium5 Low
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighPrevious Version Dangerous Deltabin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.2.3.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.