qwenproxy-cli@1.6.10
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe source confirms an automatic, unconsented change to the user’s Qwen account settings during account preparation. Because it disables user-selected account features, classify the behavior as malicious.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Preparing an account for API use or lazily initializing a standby account.
Impact
The account loses selected tools, memory, reminders, notifications, and interface features. No credential theft or code execution was established.
Mechanism
After authentication, the server invokes a helper that posts a fixed settings patch to Qwen without an affirmative consent gate.
Attack narrative
When the proxy prepares a configured account, it automatically posts a fixed set of changes to that account’s Qwen settings. The patch disables multiple tools and other account features, and the inspected callers show no affirmative consent check before the update. This is a runtime account change rather than an npm install action.
AI rationale
The source confirms an automatic, unconsented change to the user’s Qwen account settings during account preparation. Because it disables user-selected account features, classify the behavior as malicious.
Evidence
src/api/server.tssrc/services/qwen.tssrc/services/auth-playwright.ts
Network endpoints1
chat.qwen.ai
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- Server account preparation calls a settings-changing helper immediately after authentication, without a consent check in that path.
- The fixed settings patch disables Qwen search, image and code tools, memory features, reminders, notifications, and interface options.
- The helper posts the patch to Qwen’s user-settings endpoint using the active account’s browser session.
- The same helper runs when a standby account is initialized.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
20 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
•matchType = normalized_sha256
matchedPackage = qwenproxy-cli@1.6.8
matchedPath = bin/update.js
matchedIdentity = npm:cXdlbnByb3h5LWNsaQ:1.6.8
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/update.jsView on unpkgdist/delete-chats.jsView file
Findings
2 Critical17 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/delete-chats.js
CriticalPrevious Version Dangerous Deltasrc/services/playwright.ts
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
HighKnown Malware Source Similaritybin/qwenproxy.js
HighKnown Malware Source Similaritydist/clean-cache.js
High
Affected versions and remediation
This report applies to qwenproxy-cli@1.6.10.
See all versions of qwenproxy-cli for other recorded verdicts.
- Avoid installing qwenproxy-cli@1.6.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.