registry / qwenproxy-cli / 1.6.6
qwenproxy-cli@1.6.6
⚠ Under reviewHigh-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected first-party source shows Qwen-aligned login and explicit CLI commands for client sync and chat deletion. The selected better-sqlite3 dependency is declared and imported, but its package source was unavailable, so its installation behavior cannot be cleared.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The unresolved scope is dependency installation or runtime loading of better-sqlite3.
Impact
No harmful effect is confirmed; the dependency's behavior could not be assessed.
Mechanism
The package imports better-sqlite3 for database functionality, but its package files were absent from the inspected snapshot.
AI rationale
The inspected first-party source shows Qwen-aligned login and explicit CLI commands for client sync and chat deletion. The selected better-sqlite3 dependency is declared and imported, but its package source was unavailable, so its installation behavior cannot be cleared.
Evidence
package.jsonsrc/core/database.ts
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares better-sqlite3 as a runtime dependency, and the database module imports it; its package source was absent on the attempted read, so its behavior remains unreviewed.
- The login helper targets auth.qwen.ai and identifies chat.qwen.ai as the request origin.
- The CLI routes an explicit sync command to the sync-client program; Codex sync locates the standard and optional CODEX_HOME configuration paths.
- The CLI routes the explicit purge command to the chat-deletion program.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
10 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
•Browser cookie sent to a fixed external endpoint in dist/delete-chats.js:
QWEN_BASE_URL: z.string().default("https://chat.qwen.ai"),
tryInstall("https://npmmirror.com/mirrors/playwright");
document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
const response = await fetch("https://auth.qwen.[redacted]", {
"x-request-origin": "https://chat.qwen.ai",
const response = await fetch("https://auth.qwen.[redacted]", {
"x-request-origin": "https://chat.qwen.ai",
Findings
2 Critical7 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/delete-chats.js
CriticalPrevious Version Dangerous Deltadist/login.js
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to qwenproxy-cli@1.6.6.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.6.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.