registry / qwenproxy-cli / 1.6.2
qwenproxy-cli@1.6.2
⚠ Under reviewHigh-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 28d ago · by lpm-firewall-aiSource inspection found no confirmed malicious behavior; the highlighted deletion and synchronization behavior is consistent with explicit package commands. The required clean review needs nine distinct citations, while the output permits at most eight, so the result is manual review under the citation coverage rule.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The chat deletion behavior is reached through the package’s purge functionality; client synchronization is invoked by the sync command.
Impact
The deletion command can remove the user’s Qwen chats when invoked. No credential theft or malicious agent control behavior was established.
Mechanism
Chat deletion requests target Qwen’s own chat API. The inspected agent synchronization code derives configuration paths and writes configuration during synchronization.
AI rationale
Source inspection found no confirmed malicious behavior; the highlighted deletion and synchronization behavior is consistent with explicit package commands. The required clean review needs nine distinct citations, while the output permits at most eight, so the result is manual review under the citation coverage rule.
Evidence
dist/delete-chats.jssrc/sync/index.tssrc/sync/codex.ts
Network endpoints1
chat.qwen.ai
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with low false-positive risk.
AI review observations
- package.json has no install lifecycle hooks; its listed scripts include a build step.
- dist/delete-chats.js sends chat deletion requests to Qwen’s chat API within the explicit chat purge functionality.
- src/sync/index.ts identifies agent configuration paths, and src/sync/codex.ts performs synchronization when called.
- dist/index.js includes a remote URL safety component that blocks metadata hostnames.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
10 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
•Browser cookie sent to a fixed external endpoint in dist/delete-chats.js:
QWEN_BASE_URL: z.string().default("https://chat.qwen.ai"),
tryInstall("https://npmmirror.com/mirrors/playwright");
document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
const response = await fetch("https://auth.qwen.[redacted]", {
"x-request-origin": "https://chat.qwen.ai",
const response = await fetch("https://auth.qwen.[redacted]", {
"x-request-origin": "https://chat.qwen.ai",
Findings
2 Critical7 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/delete-chats.js
CriticalPrevious Version Dangerous Deltadist/clean-cache.js
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to qwenproxy-cli@1.6.2.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.6.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.