xchange-cli@0.12.31
Use GPT (any ChatGPT plan with Codex), DeepSeek and 400+ other models in the Claude Desktop Code tab and Claude Code while staying signed in to your Claude subscription — no third-party gateway mode. Several ChatGPT accounts that take over when one runs o
AI Security Review
scanned 11h ago · by lpm-firewall-aiThe package has a plausible router and desktop-app purpose and no install lifecycle hooks, but heavily obfuscated code runs during module loading in multiple runtime files. With its behavior not established, this warrants a warning rather than a malware block.
Decision evidence
public snapshot- The systemd module runs an obfuscated wrapper during module evaluation, immediately before importing child_process.
- The desktop app main file also runs an obfuscated wrapper during module evaluation.
- The CLI entry point imports local modules for its router and supervisor functions.
- The package describes an AI model router and desktop integration tool.
- The manifest declares no install, preinstall, or postinstall lifecycle scripts.
- The shipped Three.js module retains its upstream license header, consistent with bundled UI code.
Source & flagged code
16 flaggedPackage source references child process execution.
dist/cli/src/systemd.jsView on unpkg · L1Package source references shell execution.
dist/cli/src/schtasks.js#virtual:normalized:round1View on unpkg · L18Findings
Affected versions and remediation
This report applies to xchange-cli@0.12.31.
See all versions of xchange-cli for other recorded verdicts.
- Review the evidence and your use of xchange-cli@0.12.31 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.