Hugging Face malicious model repositories hijack GPUs for crypto mining, reappear within days after takedown

Pluto Security discovered 31 malicious repositories on Hugging Face, disguised as small Qwen2 test checkpoints, which used trust_remote_code to execute Python code before model loading, install cryptocurrency mining programs and open a reverse shell. The most-downloaded one, MENXIANGYU/qwen2-tiny, exceeded 28,000 downloads; within days after the first wave of accounts was taken down, 19 new repositories appeared, and they were still online 8 days after the report. Researchers said the platform's scanning only checks for known malware and unsafe model formats, and the second wave of flagship models scanned as clean. In another report, the SolanaUpdateTools/solana-starter-kit repository on GitHub contained only a README, luring AI coding agents to execute PowerShell commands to install NetSupport RAT.