registry / qwenproxy-cli / 1.2.7
qwenproxy-cli@1.2.7
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is a local Qwen API gateway whose agent-config writes and self-update are gated by explicit user commands, and package.json has no install lifecycle hooks. Searched source shows no hidden exfiltration, eval-based payload, or self-dependency install chain.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No automatic trigger. Sync and update run only when the user invokes those CLI commands.
Impact
No unconsented credential theft, remote payload execution, or install-hook mutation of agent control files was found.
Mechanism
The CLI dispatches to local TypeScript entrypoints. Sync writes local agent settings to point at the local proxy; update checks the npm registry and installs this package globally.
AI rationale
The package is a local Qwen API gateway whose agent-config writes and self-update are gated by explicit user commands, and package.json has no install lifecycle hooks. Searched source shows no hidden exfiltration, eval-based payload, or self-dependency install chain.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only user-run scripts such as start, tui, login, and sync, and has no preinstall, install, or postinstall hook.
- Agent config paths in src/sync/index.ts are local home files such as ~/.claude/settings.json and Codex config.toml, used by the explicit sync command.
- bin/qwenproxy.js starts client sync only when the first argument is sync, and runs the updater only when the first argument is update.
- The updater queries the npm registry for this package's latest version from the explicit update command.
Evidence against
- Running the sync command rewrites local settings for several third-party coding agents and keeps timestamped backups.
- The first browser command may download Chromium through Playwright or a public mirror.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
src/core/accounts.tsView file
22function parseEnvAccounts(): QwenAccount[] {
L23: const envAccounts = process.env.QWEN_ACCOUNTS;
L24: if (!envAccounts) return [];
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/accounts.tsView on unpkg · L22Findings
5 High3 Medium5 Low
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighPrevious Version Dangerous Deltabin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.2.7.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.2.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.