registry / qwenproxy-cli / 1.4.3
qwenproxy-cli@1.4.3
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is a local Qwen API gateway whose agent-config writes and self-update are gated behind explicit CLI or TUI actions, with no install lifecycle hook or hidden credential export. Those user-invoked, package-aligned behaviors do not form an attack chain.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs qpx sync, confirms sync in the TUI, or runs qpx update.
Impact
Those actions change the user's own client settings or this package installation only after the user invokes them. Install does not mutate agent configs.
Mechanism
Sync points selected local coding clients at this proxy. Update queries the npm registry for this package name and installs a newer global release.
AI rationale
The package is a local Qwen API gateway whose agent-config writes and self-update are gated behind explicit CLI or TUI actions, with no install lifecycle hook or hidden credential export. Those user-invoked, package-aligned behaviors do not form an attack chain.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json scripts start with build and prepack and contain no preinstall, install, or postinstall hook, and dependencies do not include this package name.
- syncCodex resolves ~/.codex/config.toml and an optional CODEX_HOME config.toml only while configuring the local proxy provider.
- The qpx entrypoint imports the updater only when the first argument is update.
- runUpdateCommand reads this package name and version from its own package.json before checking the npm registry.
Evidence against
- The sync command and the TUI sync view rewrite coding-client configs such as Codex and Claude settings, but only after the user runs qpx sync or confirms sync in the TUI.
- The updater shells out to install a newer global release of the same package, and that path is not an install lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
8 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
25function getOsGlobalDataDir(options) {
L26: const currentPlatform = options?.platform || process.platform;
L27: const home = options?.homeDir || os.homedir();
L28: if (currentPlatform === "win32") {
L29: const winPath = path.win32 || path;
L30: const appData = options?.appData || process.env.APPDATA || winPath.join(home, "AppData", "Roaming");
L31: return winPath.join(appData, "qwenproxy");
...
L54: platform: options?.platform,
L55: appData: options?.appData,
L56: homeDir: options?.homeDir,
...
L107: if (fs2.existsSync(KEY_PATH)) {
L108: cachedKey = Buffer.from(fs2.readFileSync(KEY_PATH, "utf-8"), "hex");
Findings
7 High3 Medium5 Low
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/delete-chats.js
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to qwenproxy-cli@1.4.3.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.4.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.