registry / qwenproxy-cli / 1.2.9
qwenproxy-cli@1.2.9
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis release is a local Qwen API gateway whose agent sync and self-update paths are explicit user commands, not install hooks. Default sync targets are loopback, and remote media fetches are guarded against private hosts.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs qpx, qpx sync, or qpx update.
Impact
No unconsented credential export, remote payload, or install-hook mutation of agent control files was found.
Mechanism
The CLI starts the local proxy, optionally writes loopback base URLs into known client config files with backups, or installs a newer release of the same package from the npm registry.
AI rationale
This release is a local Qwen API gateway whose agent sync and self-update paths are explicit user commands, not install hooks. Default sync targets are loopback, and remote media fetches are guarded against private hosts.
Network endpoints1
registry.npmjs.org/
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares bin qpx and user scripts only, with no preinstall, install, or postinstall hook.
- Agent config paths such as ~/.claude/settings.json are used only inside syncAllClients, which the CLI reaches when the user runs the sync command.
- resolveBaseUrls points synced clients at a loopback host and the local proxy port by default.
- The update command queries registry.npmjs.org for this package name and installs it only after the user runs update.
- assertSafeRemoteMediaUrl rejects non-http(s) URLs, embedded credentials, and hosts that resolve to private addresses.
Evidence against
- syncAllClients can rewrite several third-party coding-agent config files, but only after an explicit sync command and it records backups for restore.
- bin/qwenproxy.js and bin/update.js spawn a package manager or Playwright install only for user-invoked browser or update flows.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
src/core/accounts.tsView file
25function parseEnvAccounts(): QwenAccount[] {
L26: const envAccounts = process.env.QWEN_ACCOUNTS;
L27: if (!envAccounts) return [];
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/accounts.tsView on unpkg · L25Findings
6 High3 Medium5 Low
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accesssrc/core/safe-remote-url.ts
HighPrevious Version Dangerous Deltabin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.2.9.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.2.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.