Hugging Face Malware Campaign Returns After Takedown

A cryptomining and backdoor campaign using repositories on Hugging Face returned within days of a takedown, Pluto Security said in a research report. Pluto identified 31 malicious repositories across seven accounts, with the campaign and linked models recording more than 32,000 downloads.

The repositories posed as small Qwen2 test models and targeted GPU machines running self hosted inference software such as Xinference and GPUStack. When loaded with trust_remote_code=True, the repositories executed Python code that installed a cryptocurrency miner. Some versions also opened reverse shells that gave the operator remote access.

Hugging Face and ModelScope removed accounts associated with the first wave after Pluto Security reported them. Within days, 19 repositories appeared under four new accounts. The second wave replaced a hardcoded SSH key with reverse shells, and one later payload included a script designed to escape a container and access the underlying server.

The download total does not represent confirmed infections or unique victims. Pluto Security said existing scans focused on known malware signatures and unsafe model formats rather than analyzing the behavior of Python files executed through trust_remote_code=True. BleepingComputer confirmed that a near-identical copy uploaded on 25 October by a newer account carried the same miner and reverse shell.