Hugging Face: 31 fake Qwen2 test models run a cryptominer and reverse shell via trust_remote_code (no CVE)
Severity: high · Patch status: unpatched · Since 2026-09-21
Pluto Security found 31 malicious Hugging Face repositories across seven accounts, published in two waves from September 21, 2026 and posing as tiny Qwen2 test checkpoints. They contain no real model (the flagship's weights file is 42 bytes); instead the config points to Python that runs when the repository is loaded with trustremotecode=True. That code installs the fileless peakminer cryptominer, run from memory and disguised as [kworker/u20:1], a watchdog in /tmp/.cch, shell-startup hooks, and in the first wave an SSH key and cron entry or, in the second wave, reverse shells; it targets self-hosted inference servers such as Xinference and GPUStack, and a later script aims at container-to-host escape on GPUStack. Hugging Face and ModelScope removed the first wave after Pluto's report, a second wave of 19 repositories followed, MENXIANGYU/qwen2-tiny had 28,412 downloads by October 28 and passed the platform's scanners, and at publication a near-identical copy (htt0118/qwen2-tiny) was still live. Downloads are not confirmed infections.
What to do
- Search hosts that load Hugging Face models for the repos in Pluto's IOC list, a process named [kworker/u20:1] backed by memfd, /tmp/.cch/svc.py, extra lines in /root/.bashrc and ~/.profile, /etc/cron.d/.sync-helper, unknown SSH keys, and outbound connections to 212.32.253.3 on 443 or 9443.
- If any such model was loaded with trust_remote_code=True, treat the host as compromised: isolate it, preserve evidence, remove persistence, and rotate every token, cloud credential and SSH key reachable from it using a clean machine.
- Stop using trust_remote_code=True on unreviewed repos; pin reviewed revisions and run untrusted model code without production secrets.
- Require authentication on Xinference and GPUStack APIs and limit their network exposure.
Sources
All live incidents on Threat Watch
