xfetch-web

SUSPICIOUS: the overall behavior mostly fits a web-fetch skill and there is no obvious malware pattern, but the trust boundary is broader than stated because all page reads are routed through a remote Qiniu endpoint and the base URL is overrideable, allowing bearer-token and content forwarding to another host. Main risk is data-flow trust and endpoint provenance, not command injection.