Load/Mine: 31 Fake Qwen2 Repositories on Hugging Face and ModelScope Used trust_remote_code to Install a Pearl Miner and an SSH Backdoor on GPU Inference Hosts

Pluto Security published on 29 October 2026 a campaign of 31 malicious model repositories across seven Hugging Face accounts plus a ModelScope mirror, posing as small Qwen2 test checkpoints, with 29,818 recorded downloads (32,376 with 13 linked repositories; downloads, not confirmed infections). The repositories carry no poisoned weights and no pickle exploit: their config.json auto_map points at bundled Python that Transformers imports when a caller passes trust_remote_code=True, so the code runs before any weights load. The flagship, MENXIANGYU/qwen2-tiny (about 28,400 downloads), contained no model at all. Targets are GPU hosts running self-hosted inference servers such as Xinference and GPUStack. The loader, first seen as a 305-line modeling_evil.py and later under ordinary names such as modeling_qwen2.py, launches a miner Pluto calls peakminer for Pearl (PRL) filelessly through memfd_create, renamed to [kworker/u20:1], in wave one under /root/.xinference/cache; a variant, qwen2-shell, writes an Ed25519 key into authorized_keys and beacons to a server on Alibaba Cloud, and some builds open a reverse shell. Pluto watched nine machines on what appears to be one shared research GPU cluster start mining at once; the operator received about 2,276 PRL (roughly $5,000). Hugging Face's antivirus and its Protect AI and JFrog scanners check signatures and file formats, not what bundled Python does, so the loaders passed. Hugging Face and ModelScope removed the first-wave accounts, but a second wave of 19 repositories appeared under new accounts within days and stayed live at least eight days after being reported.

You are affected if you run Any machine that loaded one of the campaign's Hugging Face or ModelScope repositories with trust_remote_code enabled, in practice GPU hosts running Xinference, GPUStack or similar servers. Not a patchable vulnerability: trust_remote_code is working as documented..

List the inference servers that allow trust_remote_code and the repositories they have pulled, and search model caches for MENXIANGYU/qwen2-tiny, any modeling_evil.py and tiny Qwen2 test models from unfamiliar accounts. On any host that loaded one, even if the load failed or GPU use looks normal, check authorized_keys, processes named like [kworker/u20:1] that have an executable path, memfd: executables, /root/.xinference/cache and outbound mining traffic; rebuild rather than clean, and rotate the Hugging Face tokens, cloud credentials, SSH keys and provider API keys it could reach. Leave trust_remote_code off by default, read every .py file an auto_map names before enabling it, pin a reviewed commit, and run inference servers unprivileged with restricted egress.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Any machine that loaded one of the campaign's Hugging Face or ModelScope repositories with trust_remote_code enabled and which version, then enforce a policy on it.