qwenproxy-cli@1.6.3
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe registry-derived version is not strictly validated before it reaches a shell-enabled process, creating an unresolved command execution vulnerability when the user runs the updater. The source supports a warning for a critical vulnerability, but does not establish malicious package behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes the update command and the registry reports a newer version.
Impact
A crafted registry response could cause local commands to run during the update.
Mechanism
The updater embeds the returned version in a package-manager command and executes that command with shell processing enabled.
AI rationale
The registry-derived version is not strictly validated before it reaches a shell-enabled process, creating an unresolved command execution vulnerability when the user runs the updater. The source supports a warning for a critical vulnerability, but does not establish malicious package behavior.
Evidence
bin/update.jsbin/qwenproxy.js
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The updater runs when the user invokes the update command.
- It accepts the registry response's version string after trimming it.
- The version comparison parses numeric prefixes without rejecting trailing text.
- The returned version is added to the package-manager arguments and passed to a shell-enabled process.
Evidence against
- The affected path requires explicit invocation of the updater; the inspected source does not establish that malicious registry metadata was served.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
10 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
•Browser cookie sent to a fixed external endpoint in dist/delete-chats.js:
QWEN_BASE_URL: z.string().default("https://chat.qwen.ai"),
tryInstall("https://npmmirror.com/mirrors/playwright");
document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
const response = await fetch("https://auth.qwen.[redacted]", {
"x-request-origin": "https://chat.qwen.ai",
const response = await fetch("https://auth.qwen.[redacted]", {
"x-request-origin": "https://chat.qwen.ai",
Findings
2 Critical7 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/delete-chats.js
CriticalPrevious Version Dangerous Deltasrc/services/playwright.ts
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to qwenproxy-cli@1.6.3.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.6.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.