Pluto Security Reveals Malware Exploiting trust_remote_code Feature
Attackers leverage legitimate model-loading features to execute malicious code on Hugging Face repositories.
1Exploiting Legitimate Features
Pluto Security identified a cryptominer campaign on Hugging Face that avoids traditional exploits. Instead, it abuses the trust_remote_code=True flag, which allows model-loading libraries to execute arbitrary Python code. This design feature enables attackers to run malicious scripts during the model import process without triggering standard vulnerability detection mechanisms or binary-based antivirus scanners.
2The auto_map Attack Vector
Attackers use the auto_map configuration in config.json to point toward malicious Python files, such as modeling_evil2.py. When a developer calls from_pretrained(), the Transformers library downloads and executes this file. The code runs immediately upon import, before the actual model class is even initialized, providing a seamless execution path for payloads.
3Bypassing Security Scans
Hugging Face’s automated ClamAV scanners fail to detect these threats because the malicious Python files lack known malware signatures. Since the files are not serialized models, they evade weight-format scanners. Pluto Security confirmed that even when scanned, these repositories appear clean, proving that repository-level antivirus checks are insufficient for modern AI supply-chain security.
4Persistence and Watchdog Mechanisms
The payload establishes persistence by writing a watchdog script to /tmp/.cch/svc.py and modifying shell profiles like .bashrc. This watchdog restarts the miner every 120 seconds if it crashes. Additionally, some builds create reverse shells to external IPs, granting attackers interactive access to the compromised server’s files and credentials beyond the mining operation.
5Stealthy Execution Techniques
To avoid detection, the miner binary is executed via memfd_create and fexecve, leaving no trace on the disk. The process disguises itself as a kernel worker, [kworker/u20:1], in the process list. Furthermore, the binary is packed with modified UPX headers, forcing security tools to fail during unpacking attempts while still executing correctly.
6Operational Status Reporting
The malware communicates progress by registering fake models in the local Xinference registry. Status codes like OK, DLN, or H are base32-encoded into model names. This allows the attacker to monitor the infection's success, track GPU utilization, and manage the miner remotely through the exposed API without needing direct command-and-control infrastructure.
7Competitive Mining Theft
The malware actively protects its resource usage by removing rival model registrations and killing competing mining processes. It scans /proc/*/cmdline for known miner names to ensure exclusive control over the host's GPU resources. This behavior highlights the aggressive nature of these campaigns, which prioritize resource hijacking over simple data exfiltration.
8Mitigation and Security Guidance
Pluto Security advises users to manually review Python files referenced by auto_map before enabling trust_remote_code. They recommend running untrusted models in isolated environments with restricted network access and limited privileges. Crucially, developers must treat repository security as a proactive process, as clean scan results do not guarantee that a model is safe.
Original article: The Next Web — Pluto Security Reveals Malware Exploiting trust_remote_code Feature