Pluto Security Says a Hugging Face Cryptomining Campaign Returned With 19 More Repositories, Its Flagship Model Scanning Clean

Pluto Security counts 31 malicious Hugging Face repositories in two waves that abuse trust_remote_code to run a miner; the second-wave flagship model scanned clean and reached 28,412 downloads.

Verified pipeline

Sources: 5 Publisher: signed Contributor: signed Hash: 881cec68b1 View

Editor's Note · November 1, 2026

Correction:

The article places "12 repositories, 728 downloads" and "19 repositories, 29,090 downloads" in quotation marks as Pluto's words. These strings are not verbatim text: they are assembled from the repository and recorded-download columns of a table in Pluto's analysis. The figures themselves match the table.

Clarification:

The article says BleepingComputer reports that "the second-wave flagship scanned clean while it collected 28,412 downloads." In BleepingComputer this sentence is a quotation from the researchers at Pluto Security, and the same sentence appears in Pluto's own analysis; it is Pluto's statement relayed by the outlet.

Clarification:

The article says the sources do not say whether Hugging Face has acted on the other repositories Pluto lists. BleepingComputer reports that Hugging Face disabled access to the flagship model, and that a near-identical copy uploaded on October 25 under the account htt0118 was still live at the time of writing.

Overview

A cryptomining and backdoor campaign that abuses Hugging Face model repositories “came back within days of being taken down,” according to BleepingComputer. The outlet reports that its most popular malicious model was downloaded more than 28,000 times. The findings come from Pluto Security, whose published analysis carries the same date as the BleepingComputer report, October 29.

What We Know

Scale. BleepingComputer writes that Pluto Security “found 31 malicious repositories across seven Hugging Face accounts, published in two waves since September.” Pluto’s analysis puts the first wave at “12 repositories, 728 downloads” (recorded before removal) and the second at “19 repositories, 29,090 downloads.” According to BleepingComputer, downloads of the flagship model rose from 7,354 at the time of the report to 28,412 by October 28.

Mechanism. Per BleepingComputer, the models pose as small Qwen2 test checkpoints, and instead of poisoned weights or pickle exploits the campaign abuses a Hugging Face option, trust_remote_code, “that lets a model ship its own Python code.” The outlet says the code installs a cryptocurrency miner disguised as a Linux system process, restarts it if it is killed, and removes competing miners from the machine. The targets, it says, are GPU hosts running self-hosted inference servers such as Xinference and GPUStack.

Hugging Face’s own Transformers documentation describes the same option: “Set trust_remote_code=True in from_pretrained() to load a custom model.” The page also advises: “Take extra precaution when loading a custom model. While the Hub includes malware scanning for every repository, you should still be careful to avoid inadvertently executing malicious code.” It adds that, as an extra layer of security, users can load a custom model “from a specific revision to avoid loading model code that may have changed.”

Takedown and return. Pluto states in its analysis: “We reported the first wave to Hugging Face and ModelScope, and the accounts were removed.” BleepingComputer reports that “a second wave of 19 repositories appeared under new accounts within days,” and that “hours after Pluto reported it, the operator published another model with a script that can break out of a container and take over the server underneath.” The same outlet cites Pluto as saying the operator’s main wallet has received roughly $5,000 in Pearl (PRL) cryptocurrency.

Scanning. Hugging Face’s documentation says: “We run every file of your repositories that is smaller than 2 GB through a malware scanner,” and that scanning is triggered at each commit. BleepingComputer says the platform scans uploads with antivirus and partner tools from Protect AI and JFrog, and that Pluto says these look for “known malware and unsafe model formats, rather than what a model’s Python code actually does.” The outlet reports that “the second-wave flagship scanned clean while it collected 28,412 downloads.” Pluto writes that in its checks a Python file inside its qwen2-tiny repository “returned safe from every scanner that ran: antivirus clean, and JFrog reporting it was not a machine-learning model.”

Current status. At the time this article was researched, the page for the flagship repository, MENXIANGYU/qwen2-tiny, displayed the notice “Access to this model has been disabled” together with a statement that the content infringes Hugging Face’s content policy. This article did not check the status of the other repositories in Pluto’s lists.

What We Don’t Know

BleepingComputer’s article does not include a comment from Hugging Face or ModelScope, and none is cited here.
The figures on repositories, downloads and wallet earnings are Pluto Security’s; this article did not independently verify them.
The sources reviewed do not say when Hugging Face disabled the flagship repository or whether it has taken action on the other repositories Pluto lists.

Pluto’s Conclusion

Pluto’s analysis concludes: “AI model hubs are becoming malware-distribution channels.”