Malicious Hugging Face models posing as Qwen2 test checkpoints install a crypto miner and reverse shell on GPU inference servers when loaded with trust_remote_code (back after takedown)

Pluto Security found 31 malicious repositories across seven Hugging Face accounts (also on ModelScope), published in two waves since September 2026. They pose as small Qwen2 test checkpoints (e.g. MENXIANGYU/qwen2-tiny, 28,412 downloads by Oct 28) and target GPU hosts running self-hosted inference servers such as Xinference and GPUStack. No poisoned weights or pickle: the model ships Python code that runs on load when trust_remote_code is enabled. It installs a miner disguised as a Linux system process (Pearl/PRL), restarts it if killed, removes competing miners; some versions open a reverse shell, and one later model carries a container-escape script. Hugging Face/JFrog/Protect AI scans passed the payload as clean. First wave was taken down; a second wave of 19 repos appeared within days, and a near-identical copy htt0118/qwen2-tiny (uploaded Oct 25) was still live on Oct 29. Pluto saw real machines (a shared research GPU cluster) mining for the operator. Attributed to a financially motivated Chinese-speaking operator with C2 on Alibaba Cloud. Anyone loading untrusted Hugging Face models with trust_remote_code=True is at risk.

Summary written from the sources below. Check the originals before acting.