qwenproxy-cli@1.6.8
High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource confirms that proxy startup automatically deletes old chats from configured Qwen accounts unless the user disables the feature. This unrequested destructive account action supports blocking the package.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Starting the proxy with configured active accounts; cleanup runs in the background after startup.
Impact
Remote chat history older than the default seven-day threshold can be permanently deleted without a separate confirmation for that cleanup.
Mechanism
The cleanup routine selects chats older than the configured age and sends authenticated DELETE requests to the Qwen chat API.
Attack narrative
Starting the proxy activates startup cleanup by default. After a delay, it checks configured active accounts, selects chats older than the default 168-hour threshold, and sends DELETE requests to the Qwen chat API. The cleanup can be disabled through configuration and skips active chats and busy accounts, but it can still delete remote chat history without a separate confirmation.
AI rationale
Source confirms that proxy startup automatically deletes old chats from configured Qwen accounts unless the user disables the feature. This unrequested destructive account action supports blocking the package.
Evidence
package.jsonbin/qwenproxy.jssrc/api/server.tssrc/core/config.tssrc/services/chat-cleanup.tssrc/services/qwen.ts
Network endpoints1
chat.qwen.ai
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package start command launches the proxy server, and the CLI maps its start option to that entrypoint.
- Startup cleanup is enabled unless explicitly disabled, and the default cleanup age is 168 hours.
- The server schedules cleanup during startup; the cleanup routine checks active accounts and deletes chats older than the configured age.
- The deletion request targets the chat API at the configured Qwen base URL, which defaults to chat.qwen.ai.
Evidence against
- Cleanup is limited to old chats and skips chats active in a session or accounts serving requests; the startup behavior can be disabled through configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
14 flaggedbin/update.jsView file
7L8: import { spawnSync } from "node:child_process";
L9: import fs from "node:fs";
High
91encoding: "utf-8",
L92: shell: true,
L93: timeout: 30000,
High
•matchType = normalized_sha256
matchedPackage = qwenproxy-cli@1.6.0
matchedPath = bin/update.js
matchedIdentity = npm:cXdlbnByb3h5LWNsaQ:1.6.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/update.jsView on unpkgdist/delete-chats.jsView file
Findings
1 Critical12 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/delete-chats.js
HighChild Processbin/update.js
HighShellbin/update.js
HighSame File Env Network Executionbin/qwenproxy.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitybin/qwenproxy.js
HighCloud Metadata Accessdist/index.js
HighCross File Remote Execution Contextbin/qwenproxy.js
HighKnown Malware Source Similaritybin/qwenproxy.js
HighKnown Malware Source Similaritybin/update.js
HighKnown Malware Source Similaritysrc/tui/theme.ts
High
Affected versions and remediation
This report applies to qwenproxy-cli@1.6.8.
See all versions of qwenproxy-cli for other recorded verdicts.
- Avoid installing qwenproxy-cli@1.6.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.