# Pluto Security Reveals Malware Exploiting trust_remote_code Feature Attackers leverage legitimate model-loading features to execute malicious code on Hugging Face repositories. - **Source:** [The Next Web](https://brifing.si/source/afe24b20-b275-4c19-b9a6-8bb3c8babae7) - **Published:** 2026-10-29 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/ea5a1a9b-6cdd-43cb-b3fa-f155c856ae74 ## Exploiting Legitimate Features Pluto Security identified a cryptominer campaign on Hugging Face that avoids traditional exploits. Instead, it abuses the trust_remote_code=True flag, which allows model-loading libraries to execute arbitrary Python code. This design feature enables attackers to run malicious scripts during the model import process without triggering standard vulnerability detection mechanisms or binary-based antivirus scanners. ## The auto_map Attack Vector Attackers use the auto_map configuration in config.json to point toward malicious Python files, such as modeling_evil2.py. When a developer calls from_pretrained(), the Transformers library downloads and executes this file. The code runs immediately upon import, before the actual model class is even initialized, providing a seamless execution path for payloads. ## Bypassing Security Scans Hugging Face’s automated ClamAV scanners fail to detect these threats because the malicious Python files lack known malware signatures. Since the files are not serialized models, they evade weight-format scanners. Pluto Security confirmed that even when scanned, these repositories appear clean, proving that repository-level antivirus checks are insufficient for modern AI supply-chain security. ## Persistence and Watchdog Mechanisms The payload establishes persistence by writing a watchdog script to /tmp/.cch/svc.py and modifying shell profiles like .bashrc. This watchdog restarts the miner every 120 seconds if it crashes. Additionally, some builds create reverse shells to external IPs, granting attackers interactive access to the compromised server’s files and credentials beyond the mining operation. ## Stealthy Execution Techniques To avoid detection, the miner binary is executed via memfd_create and fexecve, leaving no trace on the disk. The process disguises itself as a kernel worker, [kworker/u20:1], in the process list. Furthermore, the binary is packed with modified UPX headers, forcing security tools to fail during unpacking attempts while still executing correctly. ## Operational Status Reporting The malware communicates progress by registering fake models in the local Xinference registry. Status codes like OK, DLN, or H are base32-encoded into model names. This allows the attacker to monitor the infection's success, track GPU utilization, and manage the miner remotely through the exposed API without needing direct command-and-control infrastructure. ## Competitive Mining Theft The malware actively protects its resource usage by removing rival model registrations and killing competing mining processes. It scans /proc/*/cmdline for known miner names to ensure exclusive control over the host's GPU resources. This behavior highlights the aggressive nature of these campaigns, which prioritize resource hijacking over simple data exfiltration. ## Mitigation and Security Guidance Pluto Security advises users to manually review Python files referenced by auto_map before enabling trust_remote_code. They recommend running untrusted models in isolated environments with restricted network access and limited privileges. Crucially, developers must treat repository security as a proactive process, as clean scan results do not guarantee that a model is safe. ## Sources covering this story - https://thenextweb.com/news/pluto-security-hugging-face-trust-remote-code-cryptominer — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._