registry / qwenproxy-cli / 1.5.0
qwenproxy-cli@1.5.0
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe manifest has no npm install hook, and the flagged shell use is part of TUI clipboard handling. Account and client configuration behavior is tied to Qwen requests or explicit CLI commands; source inspection did not establish a concrete attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The inspected behaviors are reached through normal CLI actions, including TUI use, login, sync, purge, and update.
Impact
No unrelated credential transfer, hidden remote code execution, or unrequested destructive action was established.
Mechanism
The source reads the clipboard for paste input, stores account cookies for Qwen requests, writes client configuration during sync, and installs a browser when a browser-dependent command needs it.
AI rationale
The manifest has no npm install hook, and the flagged shell use is part of TUI clipboard handling. Account and client configuration behavior is tied to Qwen requests or explicit CLI commands; source inspection did not establish a concrete attack.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares no npm install hook. The launcher reaches the updater only for the explicit update command.
- The flagged clipboard read is used by TUI paste handling; it is not sent to a remote service.
- Codex configuration writes occur in the client sync flow, which is exposed as an explicit CLI command with restore options.
- Login and session code sends credentials to Qwen authentication endpoints and keeps cookies in account-scoped caches for Qwen requests.
- The chat deletion routine is exposed through the explicit purge command and operates on configured Qwen accounts.
- The inspected dependency manifests and source describe HTTP serving, object storage, and SQLite behavior; their scripts show no install hook.
Evidence against
- The scanner’s shell and network signals correspond to clipboard support, browser setup, and the explicitly invoked updater; source inspection did not establish unrelated collection or hidden destructive behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
9 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
25function getOsGlobalDataDir(options) {
L26: const currentPlatform = options?.platform || process.platform;
L27: const home = options?.homeDir || os.homedir();
L28: if (currentPlatform === "win32") {
L29: const winPath = path.win32 || path;
L30: const appData = options?.appData || process.env.APPDATA || winPath.join(home, "AppData", "Roaming");
L31: return winPath.join(appData, "qwenproxy");
...
L54: platform: options?.platform,
L55: appData: options?.appData,
L56: homeDir: options?.homeDir,
...
L107: if (fs2.existsSync(KEY_PATH)) {
L108: cachedKey = Buffer.from(fs2.readFileSync(KEY_PATH, "utf-8"), "hex");
Findings
1 Critical7 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltabin/qwenproxy.js
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/delete-chats.js
Low
Affected versions and remediation
This report applies to qwenproxy-cli@1.5.0.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.