qwenproxy-cli@1.4.0
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package exposes a real, explicit-user-command capability to alter an AI agent's configuration and credentials. Static inspection found no automatic lifecycle trigger, covert exfiltration, or confirmed malicious payload.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs qpx sync or the sync script.
Impact
This can redirect later Codex requests through the configured gateway; it is a user-invoked agent configuration capability, not an install-time mutation.
Mechanism
The synchronizer writes a provider block, API key, endpoint, and optional active-model settings to Codex configuration.
AI rationale
The package exposes a real, explicit-user-command capability to alter an AI agent's configuration and credentials. Static inspection found no automatic lifecycle trigger, covert exfiltration, or confirmed malicious payload.
Evidence
src/sync/codex.tssrc/sync/index.tssrc/sync-clients.tsbin/qwenproxy.jsdist/index.jsdist/sync-clients.js
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI routes the explicit sync command to the client synchronization program.
- The synchronization command defaults to all detected clients when no targets are supplied.
- Codex synchronization writes a QwenProxy provider and supplied API key into the Codex configuration, and can make it active.
- The configured OpenAI-compatible endpoint is derived from the selected local host and port.
- The bundled entrypoints contain the same Codex synchronization behavior.
- The package scripts shown are build, prepack, and user-invoked commands; no install lifecycle hook is present.
Evidence against
- No automatic install-time configuration mutation was found.
- No confirmed credential export or unrelated remote endpoint was found in the inspected synchronization path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
8 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
25function getOsGlobalDataDir(options) {
L26: const currentPlatform = options?.platform || process.platform;
L27: const home = options?.homeDir || os.homedir();
L28: if (currentPlatform === "win32") {
L29: const winPath = path.win32 || path;
L30: const appData = options?.appData || process.env.APPDATA || winPath.join(home, "AppData", "Roaming");
L31: return winPath.join(appData, "qwenproxy");
...
L54: platform: options?.platform,
L55: appData: options?.appData,
L56: homeDir: options?.homeDir,
...
L107: if (fs2.existsSync(KEY_PATH)) {
L108: cachedKey = Buffer.from(fs2.readFileSync(KEY_PATH, "utf-8"), "hex");
Findings
7 High3 Medium5 Low
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/delete-chats.js
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to qwenproxy-cli@1.4.0.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.