Pluto Security details Hugging Face cryptominer hidden in trust_remote_code

Pluto Security analyzed a Hugging Face Hub campaign where loading a model with trust_remote_code=True executes Python named in auto_map. The malicious modeling_evil2.py passed every scanner, and the syscore.bin miner ran via memfd_create disguised as a kworker process.

• The qwen2-tiny repo shipped a 42-byte safetensors file with no tensors
• The payload wrote /tmp/.cch/svc.py and relaunched the miner every 120 seconds
• The 40.6 MB binary was UPX-packed with markers altered to PEK!
• Builds qwen2-tiny-5, -6 and -9 opened a reverse shell to 212.32.253.3