Pluto Security finds cryptominers in Hugging Face model repositories

Pluto Security identified a campaign that used 28 repositories on Hugging Face to distribute cryptocurrency miners and backdoors disguised as Qwen2 models, according to HackerNoon. The campaign began in September 2026, went through more than 40 code revisions, and recorded 21,614 downloads across its repositories and linked models by October 25.

The malicious repositories used the documented trust_remote_code option in Hugging Face Transformers. An auto_map entry directed the library to download and run a Python file with the user's privileges when loading the model. One repository contained a 42 byte model.safetensors file with no tensors, while the executable code was in separate Python files that available malware scanners did not flag.

Hugging Face and ModelScope removed the accounts and mirror associated with the first wave after Pluto Security reported them. A second wave appeared within days under four new accounts, replacing a fixed SSH key with reverse shells and revised loaders. The payload ran a miner from memory, disguised its process as a kernel worker, and added shell startup hooks and a watchdog to maintain access.

Pluto Security advises users to inspect Python files referenced by auto_map before enabling remote code, pin reviewed revisions, and run untrusted models with limited privileges and restricted network access. Teams that loaded the affected models should check for the miner and persistence files, then rotate accessible tokens, passwords, cloud credentials, and SSH keys from a clean machine.