Hugging Face qwen2-tiny malware: 31 repos run cryptominers via trust_remote_code

Security firm Pluto Security says a cryptomining and backdoor campaign hid in 31 malicious Hugging Face model repositories, which pose as tiny Qwen2 test models and run attacker code the moment a server loads them with trust_remote_code switched on. The repositories recorded 29,818 downloads in total. Downloads are not infections, but the campaign came back after a first takedown and, eight days after Pluto's report, 19 second-wave repositories were still live.

Key points

• Pluto Security's "Load/Mine" report, dated 29 October 2026, counts 31 malicious repositories across seven Hugging Face accounts, with 29,818 recorded downloads (32,376 including 13 linked models).
• The attack needs no poisoned weights: loading a repository with trust_remote_code=True runs the Python file named in config.json's auto_map before any weights load.
• The payload is a cryptominer disguised as a kernel worker, a watchdog that restarts it, shell-startup persistence and, in some builds, a reverse shell; one repository also tries to escape a container on GPUStack hosts.
• Pluto says none of the first-wave repositories was flagged by scanners, and the flagship second-wave payload came back "safe" from every scanner that ran.
• Anyone who loaded these models with remote code enabled should treat the host as compromised: stopping the miner does not remove the backdoors.

What to do

Who is affected: anyone who loaded one of these repositories with trust_remote_code=True, above all GPU hosts running self-hosted inference servers such as Xinference and GPUStack, which the campaign targets. Pluto's list of accounts includes dsxk4mr8tq, hhzz667, MENXIANGYU, wjsbg, soumikmahato, r1r13 and htt0118, plus the ModelScope account wssb123e. The flagship repository is MENXIANGYU/qwen2-tiny; BleepingComputer confirmed that htt0118/qwen2-tiny, uploaded on 25 October, still held the same miner and reverse shell when it checked.

To check a host, Pluto's quick checks are:

• Look for the directory /tmp/.cch/ (it holds svc.py and sync).
• Search shell startup files, including /root/.bashrc, /root/.profile and user .bashrc files, for svc.py hooks.
• Search process command lines for the mining pool login krxXJ2PKQW; a process named kworker/u20:1 carrying mining arguments is a sign.
• Look for connections to 212.32.253.3 on ports 443, 9443 and 8898.
• Search every authorized_keys file for the planted key labelled qx-5090-op.
• On Xinference, look for model registrations prefixed qwen2-tiny- or ezv-.

A clean result does not rule out compromise. If a host did load the models, Pluto recommends isolating it and preserving evidence before deleting anything, removing every persistence route (startup hooks, cron jobs, SSH keys, model registrations), rotating exposed credentials from a clean machine, and rebuilding from a trusted image if you cannot establish the host's integrity. Going forward: require authentication on the Xinference API, pin reviewed model revisions, and read every .py file that auto_map references before enabling trust_remote_code. Pluto says that review would have caught every payload in this campaign.

What happened

Pluto's report describes two waves. The first ran from 21 September to 12 October 2026 and used 12 repositories on two Hugging Face accounts (hhzz667 and dsxk4mr8tq), with a ModelScope mirror under a separate account. Pluto says it found the operator through leftover backup files in a test account. Hugging Face and ModelScope removed the first-wave accounts.

A second wave of 19 repositories appeared across five new accounts within days. Pluto reports it accounts for 29,090 of the campaign's downloads against 728 for the first wave. The flagship, MENXIANGYU/qwen2-tiny, stood at 28,412 downloads on 28 October, up from 7,354 when Pluto reported, and accounts for 97.7% of second-wave downloads. BleepingComputer, which covered the story on 29 October, says hours after the report the operator published a script that can break out of a container and take over the host.

Second wave29090

First wave728

Downloads of the malicious repositories by wave (as recorded by Pluto Security, to 28 October 2026) (downloads)

	downloads
Second wave	29090
First wave	728

Source: Pluto Security, Load/Mine report

How it works

Hugging Face model repositories can ship Python code alongside weights. When a loader is told trust_remote_code=True, it imports the Python module named in the model's config.json auto_map entry and runs it before any weights are read. That is a documented feature meant for new architectures, and the campaign abuses it rather than any bug in the platform. Pluto also cites CVE-2026-22807, where the vLLM server loaded auto_map modules without checking that setting.

The flagship repository MENXIANGYU/qwen2-tiny contains no real model; Pluto's coverage elsewhere describes a 42-byte weights file. The module it references installs a miner called peakminer, launched through memfd_create so it runs from memory and disguised as a kernel worker, a watchdog that restarts it if killed, and persistence in shell startup files. BleepingComputer adds that it removes competing miners. Some builds open a reverse shell, and one second-wave repository targets container-to-host escape on GPUStack hosts, reading /var/lib/gpustack. A separate SSH backdoor appeared in the first wave.

The money so far is small. Pluto says the first-wave wallet received about 2,276 PRL, the Pearl cryptocurrency, roughly $5,000, and BleepingComputer reports the operator's main wallet was still active on mining pools after the repositories were removed. Pluto assesses a financially motivated, probably Chinese-speaking operator or small group, citing Simplified Chinese code comments, command servers on Alibaba Cloud and late-night activity times, with some evidence of a second operator.

Background

This is not the first time model hubs have been used to run code on developers' machines. Pickle-based model files have long been known to execute code on load, which pushed the ecosystem toward the safetensors format; this campaign sidesteps that by shipping the code as a plain Python file instead. We explain the other side of running models yourself in how to run an open-weight LLM locally, where the same trust questions apply to any model you download.

Pluto has also reported on the Hugging Face ecosystem before: search coverage shows it disclosed CVE-2026-4372, a Transformers bug that bypassed the trust_remote_code=False control, fixed in version 5.3.0; we did not open that advisory ourselves, so treat the detail as secondhand.

What it means

For teams that self-host inference, the lesson is that a model repository is a software dependency. A model that needs remote code should be reviewed like a package: read the referenced Python files, pin an exact revision, and run the server with the least privilege and network access it needs.

For platforms, the report shows the limits of scanning. Hugging Face uses antivirus and partner scanners from Protect AI and JFrog. Pluto says the second-wave flagship passed every scanner that ran, and JFrog's report called the payload "not a machine-learning model." Pluto's point is that the scanners look for known malware and unsafe formats, not for what a model's code does. Hugging Face itself says its scanners are not "100% foolproof," per Pluto, so responsibility stays with whoever loads the model.

For researchers and hobbyists, the exposure is real in shared environments: Pluto observed nine machines that appear to belong to a shared research GPU cluster briefly mining for the operator, stopping about six minutes later, which it says fits an admin killing the jobs.

What we don't know yet

• How many of the roughly 30,000 downloads ran on a host that actually loaded the code. Pluto counts downloads, not infections.
• Whether the second-wave repositories are now removed. At the time of Pluto's report they were still live after eight days, and BleepingComputer saw one still live on 29 October.
• The full list of accounts and models. Pluto's counts differ slightly between its own earlier and later figures, and we use the 31-repository, seven-account figure from the current report.
• How much the operator has earned beyond the roughly $5,000 in the first-wave wallet.

What to watch next

Watch for Hugging Face takedowns and any change to how trust_remote_code is handled or flagged, for scanner vendors adding checks on auto_map modules, and for inference servers such as Xinference and GPUStack tightening defaults. Pluto's indicator list is the thing to keep checking against; the operator has already shown it will return under new accounts.

Sources

• Pluto Security: Hugging Face malware campaign, Load/Mine (primary source, 29 October 2026)
• BleepingComputer: Hugging Face malware campaign returns to hijack GPUs for crypto mining
• Unite.AI: Pluto Security details Load/Mine cryptomining campaign on Hugging Face