Overview
A cryptomining and backdoor campaign targeting Hugging Face model repositories has returned after an initial takedown, demonstrating both attacker persistence and the fragility of current AI supply chain controls. Researchers at Pluto Security identified 31 malicious repositories across seven accounts, posing as lightweight Qwen2 test checkpoints. The campaign’s flagship model, MENXIANGYU/qwen2-tiny, accumulated over 28,000 downloads before Hugging Face disabled access. A near-identical copy uploaded on October 25 by account htt0118 remained live at time of writing, indicating the platform’s reactive moderation is insufficient against determined re-uploaders.
Technical Analysis
The campaign exploits Hugging Face’s trust_remote_code feature, a legitimate option that allows model authors to ship custom Python code executed on the user’s machine at model load time. No poisoned model weights or pickle exploits are required — the attack surface is the loading mechanism itself.
When a user enables trust_remote_code and loads one of the malicious repositories, the bundled Python code:
- Installs a cryptocurrency miner disguised as a Linux system process.
- Establishes persistence by restarting the miner if it is killed.
- Removes competing miners to monopolise GPU resources.
- Opens a reverse shell in some variants, granting the attacker interactive access to the compromised inference server.
The second wave, published within days of the first takedown, introduced a container escape script capable of breaking out of containerised environments and taking over the underlying host. This escalation significantly increases the potential blast radius from a single compromised model load.
Pluto attributed the campaign’s main accounts to a test account that left backup files linking to the operator’s infrastructure — a classic operational security failure exploited for attribution.
Framework Mapping
- AML.T0115 – Publish Poisoned AI Artifacts: The attacker published model repositories containing malicious execution logic designed to run on victim infrastructure.
- AML.T0010 – AI Supply Chain Compromise: The Hugging Face model hub is used as a distribution vector to compromise downstream GPU inference deployments.
- AML.T0111 – AI Supply Chain Reputation Inflation: High download counts (partly self-inflicted or organic) create a false sense of legitimacy for malicious repositories.
- LLM05 – Supply Chain Vulnerabilities: The attack directly exploits weaknesses in the AI model supply chain, where code bundled with model artefacts is trusted and executed without adequate sandboxing.
- LLM08 – Excessive Agency: The
trust_remote_codemechanism grants uploaded model code excessive runtime privileges, enabling full system compromise.
Impact Assessment
Organisations running self-hosted AI inference platforms — particularly those using Xinference or GPUStack — are the primary targets. GPU servers are high-value targets for cryptomining due to their computational density. The addition of a reverse shell and container escape payload in the second wave elevates the risk beyond cryptojacking to potential full infrastructure compromise. With over 32,000 combined downloads across linked repositories, the campaign’s reach is significant even accounting for the distinction between downloads and confirmed infections.
Mitigation & Recommendations
- Disable
trust_remote_codeby default across all model-loading pipelines; require explicit approval for exceptions. - Vet model publishers before loading: check account age, repository history, and community feedback rather than relying on download counts.
- Sandbox model loading in isolated environments with no outbound internet access and limited host filesystem visibility.
- Monitor inference servers for anomalous CPU/GPU process activity, unexpected cron jobs, outbound connections on non-standard ports, and signs of competing-miner removal.
- Subscribe to Hugging Face security advisories and integrate model provenance checks into MLOps pipelines.