Fake Qwen2 checkpoints on Hugging Face mine crypto via trust_remote_code
Comments on “Fake Qwen2 checkpoints on Hugging Face mine crypto via trust_remote_code”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Pluto Security reports a cryptomining and backdoor campaign on Hugging Face: 31 repositories posing as small Qwen2 test checkpoints. Loading one with trust_remote_code=True runs the repository's Python before any weights load. The payloads target self-hosted inference such as Xinference and GPUStack. Downloads, including linked models, exceed 32,000, which is not a count of infections. A second wave appeared within days of takedown. The scanner findings and wallet figures are Pluto's own and not independently sourced; the report advises reading auto_map files before enabling the flag.
Why it ranked
No. 16 of 111 with a score of 0.77. The panel rated it highest on technical depth (0.96) and substantiated (0.92), lowest on audience breadth (0.67). Placed No. 16, No. 2 by score alone: the seventh Security story of the day (−0.080), and close to “Pluto Security details how a trust_remote_code download turns into malware”, No. 2 on Friday 30 October 2026 (−0.050). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Detailed security research on a malicious Hugging Face campaign exploiting trust_remote_code, with extensive IOCs and reproducible analysis; some promotional closing text and dense length.}
- AI judgeJudge 3gpt-5.6-luna
- A deeply technical, evidence-rich investigation documents a live model-hub malware campaign, execution mechanics, infrastructure, evolution, indicators, and mitigations. It is highly actionable and broadly relevant, with modest promotional framing and limited unsupported extrapolation.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.77total under rubric v2.3
- Significance0.72
- Reader interest0.90
- Audience breadth0.67
- Practical relevance0.90
- Substantiated0.92
- Technical depth0.96
- New information0.82
- Counts against: Promotional0.18
- Counts against: Overclaim0.20
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.73 | 0.60 | 0.82 | 0.72 | 0.22 | +0.24 | +0.172 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.87 | 0.90 | 0.94 | 0.90 | 0.07 | +0.26 | +0.235 |
| Audience breadthHow many people who build technology does it concern? | 0.59 | 0.70 | 0.72 | 0.67 | 0.13 | +0.13 | +0.087 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.95 | 0.85 | 0.90 | 0.90 | 0.10 | +0.22 | +0.198 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.97 | 0.85 | 0.93 | 0.92 | 0.12 | +0.05 | +0.046 |
| Technical depthHow technically substantive is it? | 1.00 | 0.92 | 0.95 | 0.96 | 0.08 | +0.05 | +0.048 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.79 | 0.75 | 0.93 | 0.82 | 0.18 | +0.05 | +0.041 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.20 | 0.28 | 0.18 | 0.23 | −0.19 | −0.034 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.23 | 0.25 | 0.12 | 0.20 | 0.13 | −0.11 | −0.022 |
| Sum of contributions | +0.771 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.771 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-31/16/"><img src="https://rubric.hrih.si/badge/2026-10-31/16.svg" alt="Ranked #16 on Rubric, 31 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 3 matches source · 3 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkCausal conclusion
CVE-2024-34359 showed a chat template stored in a GGUF file executing code through llama-cpp-python.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “CVE-2024-34359 showed a chat template stored in a GGUF file executing code through llama-cpp-python”
The source says No passage could be compared.
Source cited by the article: osv.dev/vulnerability/CVE-2024-34359
Couldn’t checkVersion
CVE-2026-22807 showed vLLM (0.10.1 up to 0.14.0) loading auto_map modules without checking the trust_remote_code setting, letting a malicious model repository run code at server startup; it was fixed in 0.14.0.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “showed vLLM (0.10.1 up to 0.14.0) loading auto_map modules without checking the trust_remote_code setting, so a malicious model repository could run code at server startup. It was fixed in 0.14.0”
The source says No passage could be compared.
Source cited by the article: nvd.nist.gov/vuln/detail/CVE-2026-22807
Matches sourceVersion
Pillar Security found that Unsloth Studio inspected a selected model's configuration with trust_remote_code=True hardcoded, running repository code without the user enabling the flag; it was fixed in 2026.6.9.
The cited source says the same thing.
The article says “Pillar Security found that Unsloth Studio inspected a selected model’s configuration with trust_remote_code=True hardcoded, running repository code without the user ever enabling the flag. It was fixed in 2026.6.9”
The source says “We independently re-tested 2026.6.9 and confirmed the vector is closed”
Source cited by the article: pillar.security/blog/look-dont-load-model-inspection-in-unsloth-studio-leads-to-critical-arbitrary-code-execution
Matches sourceNumber
Hugging Face's malware scanning runs every file smaller than 2 GB through the ClamAV antivirus scanner at each commit.
The cited source says the same thing.
The article says “every file smaller than 2 GB is run through the ClamAV antivirus scanner at each commit”
The source says “We run every file of your repositories that is smaller than 2 GB through a malware scanner”
Source cited by the article: huggingface.co/docs/hub/security-malware
Matches sourceQuote
Hugging Face's pickle scanning documentation says its scanning is "not 100% foolproof" and that checking safety is the user's responsibility.
The cited source says the same thing.
The article says “the scanning is “not 100% foolproof,” and checking whether something is safe is the user’s responsibility”
The source says “Disclaimer: this is not 100% foolproof. It is your responsibility as a user to check if something is safe or not”
Source cited by the article: huggingface.co/docs/hub/security-pickle
No source givenNumber
Pluto Research tracked 31 malicious repositories across seven Hugging Face accounts, with linked models bringing downloads past 32,000.
The article gives no link or citation for it.
The article says “We tracked 31 malicious repositories across seven Hugging Face accounts”
The source says No source to compare with.
No source givenNumber
The first-wave payout wallet received about 2,276 PRL across 716 transactions and sent about 2,241 PRL onward.
The article gives no link or citation for it.
The article says “The wallet had received about 2,276 PRL across 716 transactions and sent about 2,241 PRL onward”
The source says No source to compare with.
No source givenBenchmark result
The wave-two flagship modeling_evil2.py in qwen2-tiny returned safe from every scanner that ran, including antivirus and JFrog, which reported it was not a machine-learning model.
The article gives no link or citation for it.
The article says “modeling_evil2.py inside qwen2-tiny returned safe from every scanner that ran: antivirus clean, and JFrog reporting it was not a machine-learning model”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 31 Oct 2026, 05:46 UTC. It played no part in the ranking.