registry / qwenproxy-cli / 1.4.7
qwenproxy-cli@1.4.7
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe package has no install-time lifecycle hook, and source inspection ties the flagged primitives to explicit update, browser setup, sync, paste, and account-management behavior. The inspected credential flows target Qwen authentication and service endpoints; no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a named CLI command, confirms a TUI action, or uses a paste key.
Impact
No unrelated credential transfer, stealth persistence, or unrequested account action was established.
Mechanism
The launcher handles package updates and missing-browser setup; sync writes selected agent settings; paste handlers read clipboard contents; account operations authenticate to and call Qwen services.
AI rationale
The package has no install-time lifecycle hook, and source inspection ties the flagged primitives to explicit update, browser setup, sync, paste, and account-management behavior. The inspected credential flows target Qwen authentication and service endpoints; no concrete attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hook; its prepack action builds the package. The launcher dispatches named commands.
- The launcher gates browser setup to browser commands and installs Chromium only when it is missing. The updater runs from the explicit update command.
- Agent configuration changes occur through the sync command or after a TUI Enter action. Codex settings receive the QwenProxy provider and can be restored from backups.
- Account sign-in sends credentials to auth.qwen.ai, and saved Qwen session data is used for Qwen service requests. Chat deletion is routed through the explicit purge command.
- The metadata host match is in a blocked-host list. Clipboard reads occur in paste handlers; no clipboard upload was identified.
- Inspected dependency manifests, entrypoints, utilities, and SDK excerpts show ordinary server, storage, and SQLite use; no attack behavior was established in those required paths.
Evidence against
- Static matches include shell, child-process, network, metadata-host, and clipboard operations; inspected source ties them to package updates, browser setup, URL blocking, and user paste actions.
Source & flagged code
9 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
25function getOsGlobalDataDir(options) {
L26: const currentPlatform = options?.platform || process.platform;
L27: const home = options?.homeDir || os.homedir();
L28: if (currentPlatform === "win32") {
L29: const winPath = path.win32 || path;
L30: const appData = options?.appData || process.env.APPDATA || winPath.join(home, "AppData", "Roaming");
L31: return winPath.join(appData, "qwenproxy");
...
L54: platform: options?.platform,
L55: appData: options?.appData,
L56: homeDir: options?.homeDir,
...
L107: if (fs2.existsSync(KEY_PATH)) {
L108: cachedKey = Buffer.from(fs2.readFileSync(KEY_PATH, "utf-8"), "hex");
Findings
1 Critical7 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltabin/qwenproxy.js
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/delete-chats.js
Low
Affected versions and remediation
This report applies to qwenproxy-cli@1.4.7.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.4.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.