The fake Qwen repo undershot its advertised weights by a factor of 34,000

The tell cost nothing to compute. Sixteen gigabytes expressed in kilobytes is 16,777,216, and dividing by the 487 that actually arrived leaves a shortfall of about 34,450 times, which is to say the download was roughly three thousandths of one percent of the thing it claimed to be ^[2][15]. Any wrapper script can do that subtraction before it unzips anything.

Where the operator did spend was distribution. The payload is commodity StealC, and the executable inside was a renamed LuaJIT interpreter, harmless by itself, doing the work of looking boring to a scanner while a file dressed as a certificate pulled the stealer in ^[4][1]. The archive sat in place and the README was rewired four days later so that every download link pointed at it ^[3], and campaigns of this shape also get listed in public AI registries such as LobeHub and Glama, where a listing reads as provenance ^[13]. (The source dates the ZIP to August 20, 2026 while dating the SlowMist report to August 28, which does not reconcile, and I would want the repository metadata before building a timeline on it ^[3][1].)

The unit economics explain why takedown is a subscription rather than a remedy. Island.io's FakeGit campaign, running since March 2025, has produced roughly 7,600 malicious repositories against more than 14 million download events, which averages about 1,842 downloads per repository ^[8][17], and 800 of those, one in ten, wear AI clothing under the AgentBaiting label that also aims at getting assistants to recommend them ^[9][16]. Megalodon, per InfoStealers, spun up more than 5,000 repositories in six hours, roughly 833 an hour ^[19][20]. Against a supply curve like that, verifying locally matters more than reporting any single repository.

Demand is the other half of it. Alibaba's genuine models passed 700 million downloads on Hugging Face ^[10], which is what makes the costume worth sewing, and the fake page sold exactly what that population wants, a fully offline model that keeps data on the machine ^[14]. The machine in question generally also holds browser cookies, saved logins and wallet material, all of which StealC enumerates and ships out alongside a screenshot ^[5].

This is probably wrong within a quarter, but for now byte count is the highest-yield control per line of code available to anyone pulling local weights. The counter-thesis is plain: a size check tests laziness rather than intent, and the day an archive arrives at the advertised 16GB with real quantized weights and a compromised loader the arithmetic goes quiet. The resilience already on display argues that day is coming, since the malware reads a backup server address from a Polygon smart contract so the operators can move infrastructure without touching code on infected machines ^[6], and the 292 brand-copying repositories flagged in late June pushing BoryptGrab across 32 wallets and 19 browsers suggest a high iteration rate ^[18].

Most teams still are not checking publisher identity or hashes at all, and that gap is exactly why the crude control earns its place: it catches every attack that left the file size unpadded.