registry / qwenproxy-cli / 1.6.7
qwenproxy-cli@1.6.7
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 11d ago · by lpm-firewall-aiStatic source review found no malicious behavior. The flagged chat deletion is an explicit Qwen purge operation, the Codex configuration change belongs to explicit synchronization, and the cloud metadata match is part of remote URL blocking.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No automatic attack trigger was found; chat deletion, client synchronization, and updating are reached through their corresponding CLI commands.
Impact
No unauthorized credential transfer, hidden persistence, or unrequested account action was established.
Mechanism
The inspected code deletes chats through Qwen, writes QwenProxy settings during Codex synchronization, and blocks remote media URLs that resolve to private or local hosts.
AI rationale
Static source review found no malicious behavior. The flagged chat deletion is an explicit Qwen purge operation, the Codex configuration change belongs to explicit synchronization, and the cloud metadata match is part of remote URL blocking.
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares the CLI entry point and build scripts; no install lifecycle script was found.
- Codex configuration writes are part of the explicit sync command, which accepts selected client targets.
- The flagged chat deletion code is reached through the purge command and sends deletion requests to the authenticated Qwen service.
- The updater and browser setup run through CLI commands; the updater invokes the package manager to update this package.
- The flagged cloud metadata host appears in remote media URL blocking checks.
- Inspected dependency sources match their named server, object storage, and SQLite library roles; no attack behavior was identified in those excerpts.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
10 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
dist/delete-chats.jsView file
•Browser cookie sent to a fixed external endpoint in dist/delete-chats.js:
QWEN_BASE_URL: z.string().default("https://chat.qwen.ai"),
tryInstall("https://npmmirror.com/mirrors/playwright");
document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
const response = await fetch("https://auth.qwen.[redacted]", {
"x-request-origin": "https://chat.qwen.ai",
const response = await fetch("https://auth.qwen.[redacted]", {
"x-request-origin": "https://chat.qwen.ai",
Findings
2 Critical7 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/delete-chats.js
CriticalPrevious Version Dangerous Deltadist/delete-chats.js
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to qwenproxy-cli@1.6.7.
See all versions of qwenproxy-cli for other recorded verdicts.
- Review the evidence and your use of qwenproxy-cli@1.6.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.