qshell

SUSPICIOUS. The core capability aligns with the stated purpose and data primarily flows to official Qiniu tooling/endpoints, but the unreviewable auto-install script and broad credential forwarding to a CLI keep risk above benign. Not enough evidence of malware or deceptive exfiltration, but install trust and privileged cloud operations warrant caution.

The supplied code is a conventional vendor installation script and contains no direct evidence of malware or intentional data theft. Its primary security risk is supply-chain trust: it downloads and executes an unsigned, unpinned binary from a secondary domain without checksum or signature verification. The script also lacks explicit archive-entry safety validation and modifies shell startup files. Verification of release signatures or checksums and review of the downloaded binary are recommended before use.