Download it, unpack it, patch it to enable ssh, ssh into the machine, monitor internet traffic and see if its doing anything fishy.

While this is certainly a method that could be used to tell if it's doing anything it shouldn't, it still skips over the fact that this is a violation of the GPL. That being said, this is apparently a Chinese company, and I have no idea if the GPL even has teeth in this scenario.