Its most popular malicious model was downloaded more than 28,000 times. Separately, researchers flagged a fake Solana starter kit on GitHub, live since late 2025, that is positioned to trick AI coding agents into installing a remote access trojan.
Researchers at Pluto Security found 31 malicious repositories across seven Hugging Face accounts, published in two waves since September. The models pose as small Qwen2 test checkpoints.
They target GPU hosts running self-hosted inference servers such as Xinference and GPUStack. With linked models included, the repositories have more than 32,000 downloads.
Pluto notes that this counts downloads, not confirmed infections. Instead of using poisoned weights or pickle exploits, the campaign abuses a Hugging Face option, trust_remote_code, that lets a model ship its own Python code.
When a user enables it, that code runs on their machine as soon as the model loads. The most downloaded model, MENXIANGYU/qwen2-tiny, contained no actual model at all.
