If you pull models onto a GPU box, read this one.
What happened
Pluto Security found 31 malicious repositories across seven Hugging Face accounts, posing as tiny Qwen2 test checkpoints. They target self-hosted inference servers like Xinference and GPUStack. The trick isn’t poisoned weights. It’s trust_remote_code, the option that lets a model ship its own Python code, which runs as soon as the model loads. The most popular one, downloaded more than 28,000 times, had no model at all. It installed a miner disguised as a system process, restarted it if killed and removed competing miners. Some versions opened a reverse shell. After the first wave was taken down, a second wave of 19 repos showed up within days. BleepingComputer also reports a fake Solana starter kit on GitHub built to trick AI coding agents into installing a remote access trojan.
My take
Leave trust_remote_code off unless you’ve read the code yourself. Stick to well-known publishers, check download counts and repo history, and keep inference boxes off the open internet.
God Bless, and Needs Garlic!
