Malicious Hugging Face models use Python imports to install miners

Pluto Security identified a cryptomining campaign on Hugging Face that executes malicious Python when developers load models with trust_remote_code=True. Its analysis describes repositories whose configuration directs the model loader to import attacker-controlled code before returning the requested model class. The payload installs a watchdog to restart the miner and adds shell startup hooks for persistence. Three builds also connect an interactive shell to the attacker, exposing the compromised process's files and credentials. Pluto found that a representative malicious Python file received clean results from the scanners that ran. The campaign uses the loader's intended behavior rather than poisoned model weights. Killing the miner or deleting the model does not remove persistence, Pluto warned.