Understand this story
Pluto Security discovered 31 malicious repositories on Hugging Face that masqueraded as small Qwen2 test checkpoints, using trust_remote_code to execute Python code before the model loaded, installing cryptocurrency mining programs and opening a reverse shell. The most-downloaded one, MENXIANGYU/qwen2-tiny, exceeded 28,000 downloads. Within days after the first wave of accounts was taken down, 19 new repositories appeared, and they were still online 8 days after the report. Researchers said the platform's scanning only checks for known malware and unsafe model formats, and the second wave's flagship model scanned as clean.
AI-generated from public reports
Latest development · Report
Hugging Face malicious model repositories hijack GPUs for crypto mining, reappear within days after takedownDevelopments
1 confirmed developments
Pluto Security discovers malicious model repository activity on Hugging Face
Source:BleepingComputer
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 30
BleepingComputer
Hugging Face malicious model repositories hijack GPUs for crypto mining, reappear within days after takedown
Pluto Security discovered 31 malicious repositories on Hugging Face, disguised as small Qwen2 test checkpoints, which used trust_remote_code to execute Python code before model loading, install cryptocurrency mining programs and open a reverse shell. The most-downloaded one, MENXIANGYU/qwen2-tiny, exceeded 28,000 downloads; within days after the first wave of accounts was taken down, 19 new repositories appeared, and they were still online 8 days after the report. Researchers said the platform's scanning only checks for known malware and unsafe model formats, and the second wave of flagship models scanned as clean. In another report, the SolanaUpdateTools/solana-starter-kit repository on GitHub contained only a README, luring AI coding agents to execute PowerShell commands to install NetSupport RAT.