THE WORLD IS NOT STANDING STILL.RSS
BIG CHANGE.
BIG CHANGE, one tap away
BIG CHANGE, one tap away

Make room for the big picture.

Add BIG CHANGE to your home screen or desktop. It opens in its own window, with the latest stories when you’re online.

iPhone & iPad
Open bigchange.ai in Safari. Tap Share, then Add to Home Screen. Turn on Open as Web App if shown, then tap Add.
Android
Open bigchange.ai in Chrome. In the browser menu, choose Install app or Add to Home screen.
Desktop
In Chrome or Edge, use the install icon in the address bar or the browser’s app menu. In Safari on Mac, choose File → Add to Dock.

Markdown edition

# Load/Mine malware targets Hugging Face model users

> Pluto Security reports malware in model repositories.

By BIGCHANGE.AI Editorial

Published: 2026-10-29T16:48:38.750Z
Updated: 2026-10-29T16:48:38.750Z
Canonical: https://bigchange.ai/blog/load-mine-hugging-face-model-malware

![Conceptual illustration of a server cabinet beside an unoccupied workstation with code-like marks on a monitor.](https://bigchange.ai/api/media/file/model-code-workstation-v1.png)
AI-generated conceptual illustration by BIG CHANGE.

[Pluto Security’s October 29 investigation](https://pluto.security/blog/hugging-face-malware-campaign-load-mine/) traces malware in Hugging Face model repositories. 

## The big change

- A model repository may contain executable software as well as weights. When teams enable custom code, the model publisher’s implementation runs inside their environment and inherits the loading process’s access.
- The choice of weight format and the decision to run repository Python address different risks. A safer format for weights does not remove the need to inspect code that the loader is separately permitted to execute.
- Hugging Face recommends reviewing custom code and pinning a specific revision. Restricting the runtime’s privileges and network access also limits what code can reach; a clean scan alone cannot establish that a repository is safe.

## How the code gets a turn

Transformers supports models whose implementation lives outside the library. [Hugging Face’s documentation](https://huggingface.co/docs/transformers/v5.20.1/models) describes loading these with `trust_remote_code=True`, and recommends selecting a specific commit hash so later repository changes do not silently change the code loaded. A pinned revision preserves what was selected; it does not make unreviewed code safe.

In Pluto’s sample, `config.json` uses `auto_map` to name a module and class. Opting into custom code imports the module, executing malicious top-level code before weights load with the loader’s privileges.

That distinction matters when assessing a model artifact. Hugging Face separately warns that [pickle deserialization can execute code](https://huggingface.co/docs/hub/security-pickle), a risk associated with the weight file format. A safer weight format does not prevent a separately authorized Python implementation from executing. Teams need to account for both the data they load and the code their loader imports.

## What the researchers found

Pluto traced 31 repositories across seven Hugging Face accounts. A second wave followed removal of the first. The 29,818 downloads combine 728 before removal and 29,090 as of October 28; adding linked models counted that day gives 32,376. Downloads do not establish infections or unique victims.

One build installed a watchdog and startup hooks; three included a reverse shell.

## Scanning and investigation

Hugging Face says it scans repository files smaller than 2 GB at each commit, and explains that a missing status badge can mean a scan is pending or failed. Pluto says the payload returned clean results from the scanners that ran. BIG CHANGE did not test the payload. A scan result is useful evidence about what that scanner detected at that time; it is not a substitute for understanding the executable code and its permissions.

Pluto advises investigating listed models loaded with custom code even if loading failed, since the payload can run before initialization. Its indicators include `/tmp/.cch/`. Startup hooks and backdoors can persist after the miner stops.

[CISA’s incident response playbook](https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Incident_Vulnerability_Response_Playbooks_508C.pdf) recommends isolating affected systems to limit further harm and preserving forensic evidence for investigation. It also recommends rotating credentials where compromise is suspected. Containment needs to account for service availability and the collection of evidence, so response teams should choose an approach suited to their environment.

[Related BIG CHANGE coverage](https://bigchange.ai/blog/poellm-malware-exposed-ai-services) examined a separate malware incident involving exposed AI services.

## Sources

- [Load/Mine: A Hugging Face Malware Campaign Returns After Takedown](https://pluto.security/blog/hugging-face-malware-campaign-load-mine/) — Investigation and indicators.
- [Loading models: Custom models](https://huggingface.co/docs/transformers/v5.20.1/models) — Documents custom-code opt-in, code review and revision pinning.
- [Malware Scanning](https://huggingface.co/docs/hub/security-malware) — Documents commit scanning, size threshold and meaning of missing badges.
- [Pickle Scanning](https://huggingface.co/docs/hub/security-pickle) — Explains the distinct code-execution risk of pickle deserialization.
- [Federal Government Cybersecurity Incident and Vulnerability Response Playbooks](https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Incident_Vulnerability_Response_Playbooks_508C.pdf) — Federal incident response guidance on containment, evidence and credential rotation.