Pluto Security published 'Load/Mine: A Hugging Face Malware Campaign Returns After Takedown' on 29 October 2026. Pluto says it tracked 31 malicious repositories across seven Hugging Face accounts, that the 19 second-wave repositories have been downloaded more than 29,000 times and were still live eight days after it reported them, and that with linked models downloads pass 32,000, a figure that "measures downloads, not confirmed infections or unique victims." (source: Pluto Security)

Pluto says loading one of the models with trust_remote_code=True runs the publisher's Python on the machine before any weights load, and that the payloads were written for GPU hosts running self-hosted inference, especially Xinference and GPUStack.

It says the flagship payload scanned clean, that Hugging Face and ModelScope took down the first-wave accounts after its report, and that within days a second wave appeared under new accounts, with revised loaders and reverse shells in place of the hardcoded SSH key. Pluto lists MENXIANGYU/qwen2-tiny, which it calls a representative mining build, at 28,412 downloads on 28 October. (source: Pluto Security)

BleepingComputer reported on 29 October that Hugging Face has disabled access to that model, but a near-identical copy uploaded on 25 October by another account was still live when it wrote, and BleepingComputer confirmed it contains the same miner and reverse shell. (source: BleepingComputer)