qveris-cn

This fragment does not directly demonstrate malware, but it specifies a remote-download-and-immediate-execution workflow for multiple JavaScript modules from `https://qveris.cn/skill/*` without any shown integrity/authenticity verification. That creates a significant supply-chain execution risk: if the remote content is tampered with, arbitrary code could be executed with access to the user-provided API key. The destructive deletion step (`qveris*` prefix) is also a notable operational risk. To reduce risk, add hash/signature verification, pin to immutable versions, and review the downloaded `.mjs` contents before execution.