Researchers at Pluto Security found 31 malicious repositories across seven Hugging Face accounts, posing as small Qwen2 test models and targeting servers with graphics cards, BleepingComputer reports. The campaign abuses the trust_remote_code setting, which lets a model run its own Python code when loaded, to install cryptocurrency mining software and, in some versions, remote access. The most popular model was downloaded more than 28,000 times, and a second wave appeared within days of the first being removed. Separate research found a fake Solana starter kit on GitHub that targets AI coding agents.

What it means: The campaign shows that AI model repositories have become a new channel for software supply chain attacks, much as the npm and PyPI package registries were before. Hugging Face's security scans look for known malware and unsafe file formats, but do not check what the Python code bundled with a model actually does, so the files passed clean. GPU servers are an attractive target because they offer a lot of computing power and often have access to cloud data and credentials. For teams experimenting with open-weight models, the basic rule is not to enable trust_remote_code for models from unknown accounts and to review the code before loading. Anyone who has loaded these models should treat the machine as compromised and rotate every credential it could reach, because simply stopping the miner does not remove the backdoors. The fake Solana kit adds a new dimension: coding agents follow instructions in README files without a human checking them, so they need limits on the commands they can run. Attackers are adapting quickly to this new reality.

Read the original on BleepingComputer

Related service: Custom software

Related stories