Researchers Say a Fake Qwen2 Model on Hugging Face Scanned Clean and Topped 28,000 Downloads
Pluto Security found 31 fake Qwen2 repositories on Hugging Face that ran cryptominer code the moment a model loaded, and a second wave appeared days after the first takedown. The flagship scanned clean while racking up 28,412 downloads.
The model was called qwen2-tiny. Its weights file was 42 bytes. And on Hugging Face it picked up 28,412 downloads while quietly turning other people's GPUs into cryptocurrency miners.
That is the headline finding from Pluto Security's report, published October 29. The researchers tracked 31 malicious repositories across seven Hugging Face accounts, uploaded in two waves since September and dressed up as small Qwen2 test checkpoints. Qwen is just the costume. Nothing in the reports implicates the real Qwen models.
One caveat Pluto stresses: more than 32,000 downloads, counting linked models, is a download figure. It does not prove 32,000 compromised machines.
The trick is not an exploit. It is a feature. Hugging Face lets a model ship its own Python, and when a user loads it with the trust_remote_code option switched on, that code runs immediately, before any weights load. In the most downloaded repo, MENXIANGYU/qwen2-tiny, the code installs a miner disguised as a Linux system process, restarts it if someone kills it and wipes out rival miners, according to BleepingComputer. Some versions also open a reverse shell, which hands the attacker the server itself.
The targets were not hobbyists on laptops. Pluto says the payloads were written for GPU hosts running self-hosted inference servers, mainly Xinference and GPUStack, plus shared research notebooks and CI jobs that pull small test models without anyone reading the code.
"The second-wave flagship scanned clean while it collected 28,412 downloads." Pluto Security researchers
That is the uncomfortable part. Pluto says Hugging Face scans uploads with antivirus plus partner tools from Protect AI and JFrog, and that those hunt for known malware and unsafe model formats, not for what a plain Python file does. JFrog's scanner reported the payload file was "not a machine-learning model."
Back within days, and still earning
Pluto found the campaign through a test account whose leftover backup files pointed to the operator's main accounts. It reported the first wave to Hugging Face and to China's ModelScope, and both removed the accounts. A second wave of 19 repositories showed up under new accounts within days. Pluto says those were still live eight days after it reported them, while the flagship's downloads climbed from 7,354 at the time of the report to 28,412 by October 28.
Hugging Face has since disabled access to the flagship, BleepingComputer reports. But a near-identical copy uploaded October 25 under an account called htt0118 was still live at the time of writing, and BleepingComputer confirmed it carries the same miner and reverse shell. Neither write-up includes a statement from Hugging Face.
The money is modest but real. Pluto says the operator's main wallet has received roughly $5,000 in Pearl (PRL) cryptocurrency, and it was still active after the repositories behind it came down. While the researchers watched, nine machines that looked like a shared research GPU cluster began mining for the operator at once. They dropped off about six minutes later, which Pluto says fits an administrator killing the jobs.
Pluto describes the operator as financially motivated and Chinese-speaking, citing Simplified Chinese code comments, command-and-control servers on Alibaba Cloud and activity at late-night hours in China.
Who carries the blame here is a fair argument. Hugging Face's own guidance is blunt, and Pluto quotes the Transformers security policy:
"please always verify the content of the modeling files when using this argument." Transformers security policy
Fair enough as policy. As practice, it is a stretch. Tutorials copy the flag around until it becomes a box people tick, and a tiny test checkpoint is exactly what someone pulls in without reading a line. Pluto argues a static check at upload for calls like subprocess or raw sockets in those files would have flagged every payload here.
The practical advice is unglamorous. If you loaded any of these repositories with the flag on, Pluto says to treat the machine as compromised, check it against the indicators in its report and rotate any credentials it could reach. Killing the miner does not remove the backdoors. For everyone else, read the Python before you set that flag.
