SlowMist: Fake Qwen Model GitHub Repo is Malware Trap

This is a sharp reminder that the AI supply chain is now an attack surface in crypto-adjacent workflows. The significance lies not in the code itself, but in trust assumptions: developers and researchers pulling open-source models may bypass security checks, and a poisoned repo can lead to credential or key theft. It affects anyone integrating third-party AI tools into trading, analysis, or wallet infrastructure. The open question is whether the industry will adopt verification standards—like signed commits or mirrors—faster than attackers iterate on impersonation.