A cryptomining and backdoor campaign abusing Hugging Face model repositories returned within days of its first takedown. Pluto Security found 31 malicious repositories across seven accounts in two waves since September, posing as small Qwen2 test checkpoints and targeting GPU hosts running self-hosted inference servers. The attacks exploit the trust_remote_code option rather than poisoned weights: the flagship model, MENXIANGYU/qwen2-tiny, contains no model at all — its code installs a crypto miner disguised as a Linux system process and, in some versions, a reverse shell. Downloads reached 28,412 for the flagship alone (32,000-plus including linked models) before Hugging Face disabled it; a near-identical copy was still live at publication. Pluto attributes the campaign to a financially motivated, Chinese-speaking operator and says AV scans missed the payloads because they do not evaluate what model code executes. Separately, Air Security found a fake Solana starter kit on GitHub — live since November 2025, ranked highly for AI coding agents — whose "installation" step runs a PowerShell one-liner installing the NetSupport RAT.

• Source article