项目可能存在恶意代码

[qwqdw2]

作者在项目中选择把高度混淆的、自执行代码放在一个不起眼的位置（chat.ts 文件的最后一行，前面加了大量空白让人不易察觉），而且该代码被删除后项目仍能正常运行。

作者声明#83

[bfloat16]

逆了一下，从链上拿代码执行，这不此地无银三百两

[WangEdward]

https://www.aikido.dev/blog/react-native-aria-attack

The wallet address used by the script (0x9BC1355344B54DEDf3E44296916eD15653844509) matches the IOC referenced in the blog post above.

---

The malicious commits seem to have been force-pushed to the repo in May 2025, according to the activity (https://github.com/LLM-Red-Team/qwen-free-api/activity) page.

[People-11]

https://github.com/search?q=org%3ALLM-Red-Team%20var%20p%3D4190681&type=code

[XXXxx7258]

#83