Pluto Security’s October 29 investigation traces malware in Hugging Face model repositories.

The big change

  • A model repository may contain executable software as well as weights. When teams enable custom code, the model publisher’s implementation runs inside their environment and inherits the loading process’s access.
  • The choice of weight format and the decision to run repository Python address different risks. A safer format for weights does not remove the need to inspect code that the loader is separately permitted to execute.
  • Hugging Face recommends reviewing custom code and pinning a specific revision. Restricting the runtime’s privileges and network access also limits what code can reach; a clean scan alone cannot establish that a repository is safe.

How the code gets a turn

Transformers supports models whose implementation lives outside the library. Hugging Face’s documentation describes loading these with trust_remote_code=True, and recommends selecting a specific commit hash so later repository changes do not silently change the code loaded. A pinned revision preserves what was selected; it does not make unreviewed code safe.

In Pluto’s sample, config.json uses auto_map to name a module and class. Opting into custom code imports the module, executing malicious top-level code before weights load with the loader’s privileges.

That distinction matters when assessing a model artifact. Hugging Face separately warns that pickle deserialization can execute code, a risk associated with the weight file format. A safer weight format does not prevent a separately authorized Python implementation from executing. Teams need to account for both the data they load and the code their loader imports.

What the researchers found

Pluto traced 31 repositories across seven Hugging Face accounts. A second wave followed removal of the first. The 29,818 downloads combine 728 before removal and 29,090 as of October 28; adding linked models counted that day gives 32,376. Downloads do not establish infections or unique victims.

One build installed a watchdog and startup hooks; three included a reverse shell.

Scanning and investigation

Hugging Face says it scans repository files smaller than 2 GB at each commit, and explains that a missing status badge can mean a scan is pending or failed. Pluto says the payload returned clean results from the scanners that ran. BIG CHANGE did not test the payload. A scan result is useful evidence about what that scanner detected at that time; it is not a substitute for understanding the executable code and its permissions.

Pluto advises investigating listed models loaded with custom code even if loading failed, since the payload can run before initialization. Its indicators include /tmp/.cch/. Startup hooks and backdoors can persist after the miner stops.

CISA’s incident response playbook recommends isolating affected systems to limit further harm and preserving forensic evidence for investigation. It also recommends rotating credentials where compromise is suspected. Containment needs to account for service availability and the collection of evidence, so response teams should choose an approach suited to their environment.

Related BIG CHANGE coverage examined a separate malware incident involving exposed AI services.