Qwen Code

• Analyzed: May 10, 2026, 6:58 AM
• Findings: 3
• Version: 1.2.0
• Reason codes:
  suspicious.dangerous_execsuspicious.exposed_secret_literal
• Engine: v2.4.23

Overview

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Findings (3)

critical

suspicious.dangerous_exec

• Location: assets/examples/headless-mode.example.js:27
• Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

• Location: scripts/qwen-code.js:27
• Finding: Shell command execution detected (child_process).

critical

suspicious.exposed_secret_literal

• Location: scripts/qwen-code.js:63
• Finding: File appears to expose a hardcoded API secret or token.