Security Analysts Warn of Qwen 3.8 27B GitHub Threat

How the Fake Repository Gave Itself Away

Security firm SlowMist found the warning signs were there for anyone who checked closely. The advertised file was only 487 KB, while a real 27 billion parameter model typically requires over 16 GB of storage. That gap alone should have raised suspicion.

The repository was also edited four days after creation, redirecting all download links to a malicious ZIP file, a common tactic once a repo has built up enough legitimacy to avoid immediate scrutiny. The file itself, named uncensored_qwen_v2.6.zip, contained an executable, a command file, and a script rather than actual model weights. Once opened, it activated the StealC info stealer, which harvests system data, screenshots, browser credentials, and cryptocurrency wallet information.

Alibaba’s official Qwen project was not affected. The fake repository existed entirely separate from anything the company published.

Before You Download Any Open Source Model

A few checks can catch most of these fakes before they cause damage.

• Compare the advertised file size against what a model of that parameter count should actually require
• Check the repository’s commit history for recent edits that redirect download links
• Confirm the publishing account is tied to an official organization or a known developer, not an impersonation
• Download in a sandboxed environment if there is any doubt
• Cross reference release links directly against the official project’s website or social channels

Real models ship as large data files. An executable, script, or command file bundled into the download should be treated as an immediate red flag rather than an unusual packaging choice.

This Was Not an Isolated Incident

SlowMist identified at least 23 other GitHub repositories using similar Lua based delivery chains. A broader campaign called FakeGit has created roughly 7,600 malicious repositories since March 2025, and one automated attack alone generated over 5,000 fake repositories in six hours.

Attackers are also using a technique called AgentBaiting, tricking AI assistants into recommending these fake tools directly to users. Some of the fraudulent projects have been listed in public AI registries like LobeHub and Glama, borrowing credibility from platforms that users already trust.

To maintain control over compromised systems, some of these campaigns read backup server addresses from smart contracts on the Polygon blockchain, giving attackers a resilient fallback if their primary infrastructure gets taken down. Security firms Island.io and InfoStealers have documented thousands of similar fake repositories pushing malware including BoryptGrab and Megalodon.

The scale of the underlying demand explains why this space keeps getting targeted. Alibaba’s legitimate models have seen over 700 million downloads on Hugging Face alone, and users chasing offline, private AI are often the ones least equipped to spot a fake before it is too late.

Hashlytics Take

The 5,000 repositories in six hours detail is the one to sit with. That’s not a lone attacker exploiting one popular model name, it’s infrastructure built specifically to outpace manual takedown and community reporting. Individual users checking file sizes will always be playing catch up against a system generating fakes faster than anyone can flag them. The actual fix has to happen upstream, at the registry and platform level, not at the point where someone is about to click download.