Pluto Security details how a trust_remote_code download turns into malware

Pluto Security analyzed a cryptominer campaign on the Hugging Face Hub that abuses trust_remote_code=True rather than an exploit. A config.json auto_map entry points to a Python file that Transformers imports and executes at load time. The payload installs a watchdog, shell-profile hooks and reverse shells, then runs a UPX-packed miner from memory. Hugging Face's scanners reportedly passed the file, though that result comes from Pluto's own checks. Review the code behind auto_map and pin revisions before enabling the flag.