Summary
- BleepingComputer reports Pluto Security identified 31 malicious repositories across seven accounts.
- The malicious models rely on optional execution of repository-supplied Python code.
- BleepingComputer reports more than 32,000 downloads, not confirmed infections or unique victims.
According to BleepingComputer, a recurring malware campaign has used Hugging Face model repositories to distribute cryptocurrency miners and remote-access components to AI infrastructure. Its 29 October report, drawing on research by Pluto Security, puts the number of malicious repositories at 31 across seven accounts and describes a second wave after the first group was removed.
The repositories presented themselves as small Qwen2 test models, a plausible format for developers testing inference software or lightweight model deployment. Their defining weakness was not a flaw in the mathematical model weights themselves. The campaign used the ability to execute custom Python supplied by a model repository during loading, a feature that can be enabled when software trusts remote code. Under those conditions the repository’s code can run with the permissions of the process that loads the model.
BleepingComputer reports that the malicious uploads targeted GPU systems running self-hosted inference tools, including Xinference and GPUStack. These environments often have expensive compute resources and may contain credentials used to access model stores, cloud platforms or supporting services. Executing attacker-controlled code inside such a process can therefore affect more than the model being tested, depending on the host’s permissions and isolation settings.
The reporting describes miner deployment, mechanisms intended to restart malicious processes and revised payloads that added backdoor functionality. Some components sought to avoid straightforward detection by using process names resembling legitimate system activity. One later repository reportedly contained a method to escape a container and compromise the underlying host. These are findings about analysed payload capabilities; they do not establish that every download produced a successful infection.
The campaign’s persistence became visible after the first takedown. BleepingComputer’s account of Pluto’s research puts the second wave at 19 repositories, while the publication independently inspected a near-identical model that remained accessible after a prominent listing was disabled. It reported 28,412 downloads for the most popular model by 28 October and more than 32,000 downloads across related repositories when linked models were included. These reported totals measure repository retrievals, not unique users, compromised hosts or successful infections.
A repository download does not imply that the downloader actually ran the code: some counts can reflect repeated retrievals, automated tools and systems configured not to execute custom model Python. Conversely, one successful execution on shared GPU infrastructure can expose credentials, computing capacity and information used by multiple projects. The published totals describe distribution rather than the number of individual users or compromised machines. According to the same report, new accounts were used after the initial removals, allowing malicious repositories to reappear despite earlier takedowns.
Hugging Face runs automated scanning on submitted files and unsafe model formats, but the reported campaign used repository-supplied Python that ran when custom code was trusted by the loader. BleepingComputer independently inspected a newly uploaded copy and found mining and reverse-shell functionality. A clean upload scan therefore did not establish that the associated model-loading code was safe to execute, particularly on a privileged GPU host.
The report also describes evidence of mining activity beyond download totals. According to BleepingComputer, Pluto researchers observed nine computers apparently belonging to a shared GPU research cluster begin mining for the operator before dropping off minutes later. The publication also relayed Pluto’s estimate that a cryptocurrency wallet associated with the operator received roughly $5,000 in Pearl. Those observations do not establish the number of affected organisations and must remain separate from the repository download figures.
The hostile Python originated in attacker-controlled model repositories hosted on Hugging Face, rather than from a confirmed intrusion into Hugging Face’s internal systems. Listings were removed and replacements subsequently appeared, according to BleepingComputer, while the number of systems on which the payloads actually ran remains undetermined. The findings document a compromise path through repository code executed during model-loading workflows.
