registry / qwenproxy-cli / 1.5.1
qwenproxy-cli@1.5.1
⚠ Under reviewHigh-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe manifest has no install hook, and the inspected cloud metadata reference belongs to a blocked-host list. Credential flow and runtime behavior across the large bundled entrypoint are not resolved well enough to support a clean or warning verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Unresolved; the reviewed source windows do not establish a complete activating path.
Impact
No confirmed malicious impact; additional source tracing is needed to resolve the remaining runtime behavior.
Mechanism
The available excerpts show client configuration writes and credential-related code, but do not establish an unconsented transfer or other attack behavior.
AI rationale
The manifest has no install hook, and the inspected cloud metadata reference belongs to a blocked-host list. Credential flow and runtime behavior across the large bundled entrypoint are not resolved well enough to support a clean or warning verdict.
Decision evidence
public snapshotAI called this Manual Review at 67.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json has no install lifecycle hook and exposes the CLI through bin/qwenproxy.js.
- The cloud metadata hostname appears in a blocked-host list for remote media URLs.
- The inspected client-sync code writes configuration during sync, but the relevant target locations do not establish the full activation and consent path.
- The available credential-related excerpts show cookie construction, but do not resolve every credential transfer caller or destination.
Evidence against
- The CLI dispatches sync, cache cleanup, and chat purge as explicit commands.
- The updater checks the npm registry and constructs a global update command when invoked.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
9 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
25function getOsGlobalDataDir(options) {
L26: const currentPlatform = options?.platform || process.platform;
L27: const home = options?.homeDir || os.homedir();
L28: if (currentPlatform === "win32") {
L29: const winPath = path.win32 || path;
L30: const appData = options?.appData || process.env.APPDATA || winPath.join(home, "AppData", "Roaming");
L31: return winPath.join(appData, "qwenproxy");
...
L54: platform: options?.platform,
L55: appData: options?.appData,
L56: homeDir: options?.homeDir,
...
L107: if (fs2.existsSync(KEY_PATH)) {
L108: cachedKey = Buffer.from(fs2.readFileSync(KEY_PATH, "utf-8"), "hex");
Findings
1 Critical7 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/clean-cache.js
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/delete-chats.js
Affected versions and remediation
This report applies to qwenproxy-cli@1.5.1.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.