Fake Hugging Face Models Mined Crypto

Pluto Security says it tracked 31 malicious repositories across seven Hugging Face accounts (report published October 29, 2026). The fakes look like small test copies of the open model Qwen2. Pluto says that when one is loaded with custom code allowed (trust_remote_code=True, or a yes at the prompt), a small Python file that comes with the model runs before any weights load and starts a hidden crypto miner, with a watchdog that restarts it every 120 seconds; three builds also open a back door. Pluto says the second batch of 19 repositories had 29,090 downloads as of October 28, 28,412 of them for one copy, and stresses that these are downloads, not confirmed infections.