qwenproxy-cli@1.4.2
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is an explicit-user-command agent configuration capability, not proven malware. Its default all-target behavior and credential-bearing provider writes create a real guarded control-surface risk.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs qpx sync or the equivalent sync script.
Impact
This can redirect configured AI clients to the selected local or caller-specified provider; no confirmed credential exfiltration or automatic attack was established.
Mechanism
The command creates or updates provider settings, including a bearer token and base URL, and defaults to all detected targets when none are selected.
AI rationale
This is an explicit-user-command agent configuration capability, not proven malware. Its default all-target behavior and credential-bearing provider writes create a real guarded control-surface risk.
Evidence
~/.codex/config.toml$CODEX_HOME/config.toml
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest exposes an explicit sync command and has only a prepack lifecycle hook in the inspected scripts.
- The qpx launcher dispatches the explicit sync subcommand to the sync client program.
- A sync without selected targets processes every supported detected client, including Codex.
- The Codex sync code writes a provider configuration containing the supplied API key and selected base URL, and can update alternate Codex configuration locations.
- The distributed sync bundle implements the same provider configuration behavior.
- No install-time hook or automatic execution path was found in the inspected manifest and launcher code.
Evidence against
- The configuration change requires the user to run the sync command.
- The inspected behavior configures a local provider and did not show a network send of an existing third-party credential.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
8 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
25function getOsGlobalDataDir(options) {
L26: const currentPlatform = options?.platform || process.platform;
L27: const home = options?.homeDir || os.homedir();
L28: if (currentPlatform === "win32") {
L29: const winPath = path.win32 || path;
L30: const appData = options?.appData || process.env.APPDATA || winPath.join(home, "AppData", "Roaming");
L31: return winPath.join(appData, "qwenproxy");
...
L54: platform: options?.platform,
L55: appData: options?.appData,
L56: homeDir: options?.homeDir,
...
L107: if (fs2.existsSync(KEY_PATH)) {
L108: cachedKey = Buffer.from(fs2.readFileSync(KEY_PATH, "utf-8"), "hex");
Findings
7 High3 Medium5 Low
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/delete-chats.js
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to qwenproxy-cli@1.4.2.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.