Pluto 'Load/Mine' cryptomining and backdoor campaign via malicious Hugging Face model repositories (trust_remote_code)

Pluto Security traced a cryptomining/backdoor campaign distributed through 31 malicious Hugging Face repositories across 7 accounts (plus a ModelScope mirror), recording over 32,000 downloads. The payload uses documented Transformers behavior: loading a repo with trust_remote_code=True imports the repo's Python (named via config.json auto_map) with the caller's privileges before any weights load. The payload drops a watchdog (/tmp/.cch/svc.py), appends persistence hooks to shell profiles, plants SSH backdoors and reverse shells, and launches a UPX-packed miner (peakminer) via memfd_create/fexecve disguised as a kernel worker; one later stage is a container-to-host escape targeting GPUStack's /var/lib/gpustack. The campaign respawned within days of takedown, dropping the hardcoded SSH key in favor of reverse shells.

Model registries are becoming a malware channel: the infection happens before inference, runs with the caller's privileges, and hides execution in the auto_map Python that HF's antivirus and weight-format scanners do not analyze. It targets self-hosted inference (Xinference, GPUStack), rented GPUs, notebooks and CI jobs, and leaves persistent backdoor/SSH access that outlasts the miner.

Loading a poisoned repository (from_pretrained with trust_remote_code=True) executes the repository's Python in the model process, dropping a miner, reverse shell, and SSH backdoor.

Hugging Face model repositories and Transformers loading of auto_map/trust_remote_code modules; self-hosted Xinference/GPUStack deployments.

Review auto_map-referenced .py files before loading; avoid trust_remote_code=True for untrusted repos; pin trusted model IDs and hashes; scan for /tmp/.cch and .bashrc hooks; check Xinference/GPUStack model registry for anomalous status entries; isolate GPU workloads.