registry / qwenproxy-cli / 1.6.4
qwenproxy-cli@1.6.4
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 20d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or concrete malicious behavior. The flagged source paths implement Qwen authentication and chat operations, local client synchronization, browser maintenance, and an explicitly invoked updater.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No malicious trigger was found; the relevant operations run through normal proxy use or explicit CLI commands.
Impact
No confirmed attack impact was established.
Mechanism
Inspected network calls support Qwen authentication and API requests, browser setup, and user-invoked client configuration and maintenance.
AI rationale
Source inspection found no install lifecycle hook or concrete malicious behavior. The flagged source paths implement Qwen authentication and chat operations, local client synchronization, browser maintenance, and an explicitly invoked updater.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies the CLI entrypoints, uses prepack only to build, and exposes chat deletion as an explicit purge command.
- AI client configuration writes are reached through sync commands and target local configuration files, including Codex config paths.
- Browser cleanup removes unused Playwright browser directories; the CLI browser installer uses the Playwright CDN or mirror.
- The purge operation deletes chats from configured Qwen accounts through Qwen chat endpoints.
- Playwright login sends the supplied password to Qwen’s authentication endpoint.
- The updater’s shell command is built from the detected package manager and package name, and runs only through the explicit update command.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
10 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
•Browser cookie sent to a fixed external endpoint in dist/delete-chats.js:
QWEN_BASE_URL: z.string().default("https://chat.qwen.ai"),
tryInstall("https://npmmirror.com/mirrors/playwright");
document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
const response = await fetch("https://auth.qwen.[redacted]", {
"x-request-origin": "https://chat.qwen.ai",
const response = await fetch("https://auth.qwen.[redacted]", {
"x-request-origin": "https://chat.qwen.ai",
Findings
2 Critical7 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/delete-chats.js
CriticalPrevious Version Dangerous Deltadist/clean-cache.js
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to qwenproxy-cli@1.6.4.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.6.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.