qwenproxy-cli@1.6.0
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 10d ago · by lpm-firewall-aiAlthough this is runtime behavior rather than an install hook, the default startup path deletes remote account conversations without an explicit deletion request. The source verifies a concrete destructive account action.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Starting the gateway server with the default configuration.
Impact
Remote conversations older than seven days can be deleted without an explicit deletion request from the account owner.
Mechanism
A delayed cleanup checks remote chats against an age threshold and sends DELETE requests for eligible records, skipping session-bound chats and busy accounts.
Attack narrative
Server initialization schedules remote chat cleanup, enabled by default, for active Qwen accounts. After a delay, it deletes chats older than the configured threshold, which defaults to seven days. The operation uses the account's Qwen session and proceeds without an explicit request to delete those chats.
AI rationale
Although this is runtime behavior rather than an install hook, the default startup path deletes remote account conversations without an explicit deletion request. The source verifies a concrete destructive account action.
Evidence
src/core/config.tssrc/api/server.tssrc/services/chat-cleanup.tssrc/services/qwen.tssrc/services/qwen-url.ts
Network endpoints1
chat.qwen.ai
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Server startup schedules the chat cleanup during initialization.
- The cleanup is enabled by default, and its default age threshold is 168 hours.
- After a delay, the scheduler runs cleanup for active accounts; it skips chats bound to active sessions and deletes chats that exceed the age threshold, while yielding to busy accounts.
- The deletion routine sends a DELETE request for the remote Qwen chat record. The default Qwen host is chat.qwen.ai.
- The cleanup is limited to old chats and skips session-bound chats or accounts with active requests, but it runs without an explicit deletion request.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
9 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
25function getOsGlobalDataDir(options) {
L26: const currentPlatform = options?.platform || process.platform;
L27: const home = options?.homeDir || os.homedir();
L28: if (currentPlatform === "win32") {
L29: const winPath = path.win32 || path;
L30: const appData = options?.appData || process.env.APPDATA || winPath.join(home, "AppData", "Roaming");
L31: return winPath.join(appData, "qwenproxy");
...
L54: platform: options?.platform,
L55: appData: options?.appData,
L56: homeDir: options?.homeDir,
...
L107: if (fs2.existsSync(KEY_PATH)) {
L108: cachedKey = Buffer.from(fs2.readFileSync(KEY_PATH, "utf-8"), "hex");
Findings
1 Critical7 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/clean-cache.js
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/delete-chats.js
Affected versions and remediation
This report applies to qwenproxy-cli@1.6.0.
See all versions of qwenproxy-cli for other recorded verdicts.
- Avoid installing qwenproxy-cli@1.6.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.