GitHub repository impersonation

The fake Qwen repo undershot its advertised weights by a factor of 34,000

SlowMist's August 28 report describes a GitHub page promising offline Qwen 3.8 27B weights and handing over a 487KB stealer instead. The byte count on a download is the cheapest integrity control a team still owns.