An information-stealing virus was uploaded to a GitHub repository disguised as downloadable weights for Alibaba's Qwen 3.8 ...