Fake Qwen2 checkpoints on Hugging Face mine crypto via trust_remote_code

Pluto Security reports a cryptomining and backdoor campaign on Hugging Face: 31 repositories posing as small Qwen2 test checkpoints. Loading one with trust_remote_code=True runs the repository's Python before any weights load. The payloads target self-hosted inference such as Xinference and GPUStack. Downloads, including linked models, exceed 32,000, which is not a count of infections. A second wave appeared within days of takedown. The scanner findings and wallet figures are Pluto's own and not independently sourced; the report advises reading auto_map files before enabling the flag.