qwenproxy-cli@1.3.6
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source establishes an explicit, broad AI-client configuration capability, including credential-bearing Codex provider setup. It does not establish covert installation behavior, exfiltration, or an active attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the sync command, optionally without selecting individual clients.
Impact
It can redirect selected or default-detected AI clients to the local configured gateway and change their active provider.
Mechanism
The sync flow chooses configured client paths and writes a QwenProxy provider block with a caller-resolved API key and base URL.
AI rationale
The source establishes an explicit, broad AI-client configuration capability, including credential-bearing Codex provider setup. It does not establish covert installation behavior, exfiltration, or an active attack.
Evidence
src/sync/codex.tssrc/sync/index.tssrc/sync-clients.tsbin/qwenproxy.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes a user-invoked sync command.
- The launcher dispatches configuration synchronization only when the user supplies the sync command.
- When no targets are supplied, synchronization selects all supported client targets.
- The Codex synchronizer builds a provider configuration containing the supplied API key and base URL, then writes the target file.
Evidence against
- The manifest has no preinstall, install, or postinstall hook.
- The configuration mutation is reached through an explicit CLI command, not package installation.
- The remote-media URL helper rejects non-HTTP protocols and embedded credentials.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
src/core/accounts.tsView file
49function parseEnvAccounts(): QwenAccount[] {
L50: const envAccounts = process.env.QWEN_ACCOUNTS;
L51: if (!envAccounts) return [];
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/accounts.tsView on unpkg · L49Findings
6 High3 Medium5 Low
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accesssrc/core/safe-remote-url.ts
HighPrevious Version Dangerous Deltabin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/accounts.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to qwenproxy-cli@1.3.6.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.3.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.