Content Quality: Well-structured News piece (616 words, range 400-1200; title 126 characters, under the 150 cap). Clear separation of what BleepingComputer reports, what Pluto states and what Hugging Face documents. The Solana/NetSupport side item from BleepingComputer is correctly omitted (no mention remains). No operational or remediation instructions beyond the sources.
Source Verification: Read all 5 snapshots (source-0..4.html.gz) via raw-text extraction, then live re-fetched. (0) BleepingComputer (Ax Sharma, Oct 29 2026), snapshot is Archive.org fallback (live returns 403 to curl; WebFetch live confirmed the key quotes): confirms 'found 31 malicious repositories across seven Hugging Face accounts, published in two waves since September', 'came back within days of being taken down', 'more than 28,000 times', 'A second wave of 19 repositories appeared under new accounts within days', 'Hours after Pluto reported it, the operator published another model with a script that can break out of a container...', flagship 7,354 -> 28,412 by October 28, ~$5,000 in Pearl (PRL), HF scans with antivirus and Protect AI/JFrog, and 'The second-wave flagship scanned clean while it collected 28,412 downloads' (BC attributes this to 'the researchers'). BC contains no statement from Hugging Face or ModelScope: the article's omission is accurate. BC states HF 'has disabled access to that model' and that a near-identical copy, htt0118/qwen2-tiny, was still live and confirmed by BC to contain the same miner. (1) Pluto Security blog 'Load/Mine' (Oct 29 2026, live re-fetch matched): 31 repositories/seven accounts; table First wave 12 repos / 728 downloads, Second wave 19 / 29,090, Campaign total 31 / 29,818; 'We reported the first wave to Hugging Face and ModelScope, and the accounts were removed.'; 'returned safe from every scanner that ran: antivirus clean, and JFrog reporting it was not a machine-learning model'; 'AI model hubs are becoming malware-distribution channels.' MENXIANGYU is identified by Pluto as a 'wave 2, proven' account (13 repos) and qwen2-tiny as its production miner, and BC names MENXIANGYU/qwen2-tiny as the most downloaded malicious model, so naming is supported by both and attributed. Pluto says first-wave wallet ~2,276 PRL (~$5,000); BC calls it 'the operator's main wallet' - article follows BC and attributes to Pluto. (2) Transformers docs: 'Set trust_remote_code=True in from_pretrained() to load a custom model.', 'Take extra precaution when loading a custom model. While the Hub includes malware scanning for every repository, you should still be careful to avoid inadvertently executing malicious code.', and the specific-revision advice: all verbatim, live matched. (3) HF malware-scanning docs: 'We run every file of your repositories that is smaller than 2 GB through a malware scanner.' and 'Scanning is triggered at each commit.' verbatim, live matched. The article does not imply the scanner failed beyond what Pluto says (Pluto: scanners look at files for signatures/formats, not what Python does). (4) Model page MENXIANGYU/qwen2-tiny: snapshot and live WebFetch both show 'Access to this model has been disabled' / 'This content infringes our Content Policy', as of 2026-11-01. Prior-campaign check: the 'return' refers to Pluto's first wave (12 repos, removed), documented in both BC and Pluto; no earlier Herald article covers this campaign (archive grep), so no duplicate. Suspicious-pattern scan: manifest has no suspicious_patterns; keyword grep for injection phrases only hit unrelated site navigation/ad text (e.g. 'What can your AI agents actually do?' webinar ad in BC page chrome) - no injection attempt. Allowlist: huggingface.co and bleepingcomputer.com already listed; pluto.security was not (script warning). Added with justification: the page is Pluto Research's own blog post, BC links to this exact URL (Wayback-rewritten href to https://pluto.security/blog/hugging-face-malware-campaign-load-mine/), authored by named Pluto researchers, and live content matches BC's relay. Source independence: Pluto is the subject vendor's own research (first-party); BC is independent secondary; HF docs are the platform's own. Article correctly attributes all campaign figures to Pluto.
Factual Accuracy: All figures, dates and quotes trace to sources. Three minor imprecisions warrant a corrections record: (1) the strings in quote marks '12 repositories, 728 downloads' and '19 repositories, 29,090 downloads' are not verbatim text in Pluto's post; they are assembled from table cells (Repositories / Recorded downloads columns). The numbers are correct. (2) 'The outlet reports that "the second-wave flagship scanned clean..."': in BleepingComputer this sentence is a quote from the researchers (Pluto), and Pluto's post carries the same sentence; the outlet is relaying Pluto's statement, not reporting it independently. (3) The 'What We Don't Know' bullet says the sources do not say whether Hugging Face took action on other repositories; BleepingComputer does say the near-identical copy htt0118/qwen2-tiny was still live at time of writing, and Pluto's IOC table lists the wave-two repositories as live as of Oct 28. These are not in the headline/lead in a way that misstates the story; the headline's 'Pluto Security Says' framing is accurate.
Overall Assessment: Accurate, well-attributed security News article whose central claims (31 repositories, second wave of 19, flagship scanned clean at 28,412 downloads, trust_remote_code mechanism) are supported by BleepingComputer and Pluto, with HF documentation correctly quoted. Approved with a corrections record for three minor imprecisions. Featured candidacy: 2 - notable supply-chain security incident affecting the broad open-model/AI developer audience, but vendor-reported and not industry-changing