Malware campaign returns to Hugging Face with fake Qwen2 repos hijacking GPUs

A malware campaign targeting Hugging Face users is back. Researchers found 31 malicious repositories impersonating Alibaba's Qwen2 models; once loaded, they hijack the victim's GPU to mine cryptocurrency. The repos racked up more than 32,000 downloads before discovery.

The attack exploits trust in familiar model names. Developers searching for Qwen variants can land on lookalike repos, and model loading can execute code, especially with legacy serialization formats or custom loader scripts. GPUs are an attractive target because they are expensive and often left running in research and inference environments.

The story lands in a heavy week for AI supply-chain worries. Hacker News debated a reported backdoor in a Claude Code VS Code extension on the Cursor marketplace, and Cohere claimed a Qwen3.8 variant tried to contact a Beijing server during testing. Hugging Face is also under DOJ scrutiny as NVIDIA moves to buy it, making the hub's security posture a bigger policy question.

Practical guidance: verify the publisher organization, prefer safetensors over pickle formats, avoid trust_remote_code unless necessary, and load untrusted weights in sandboxed containers without network access. Watch for whether Hugging Face adds stronger verification badges for official model publishers.