--- title: Pluto Security details how a trust_remote_code download... description: A Hugging Face model using trust_remote_code=True can run a cryptominer and, in some builds, a reverse shell, while every scanner reports it clean, according... canonical: https://daily.dev/posts/pluto-security-details-how-a-trust-remote-code-download-turns-into-malware-sndx2vogo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Pluto Security details how a trust_remote_code download turns into malware | daily.dev og:description: A Hugging Face model using trust_remote_code=True can run a cryptominer and, in some builds, a reverse shell, while every scanner reports it clean, according... og:url: https://daily.dev/posts/pluto-security-details-how-a-trust-remote-code-download-turns-into-malware-sndx2vogo og:image: https://api.daily.dev/og/posts/SnDX2vOgO.png og:image:alt: Pluto Security details how a trust_remote_code download turns into malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Pluto Security details how a trust_remote_code download turns into malware **[The Next Web](https://daily.dev/sources/tnw)** · 6 min read · 0 upvotes · 0 comments ## Summary A Hugging Face model using trust_remote_code=True can run a cryptominer and, in some builds, a reverse shell, while every scanner reports it clean, according to Pluto Security's analysis. Calling from_pretrained() with trust_remote_code=True imports a Python module named in config.json's auto_map, and its top-level code runs before the requested class is even returned. The representative repository, MENXIANGYU/qwen2-tiny, ships a 42-byte safetensors file with no real weights. The payload installs a watchdog at /tmp/.cch/svc.py, hooks shell profiles for persistence, and disguises its 40.6 MB UPX-packed miner binary (peakminer) as a kernel worker via memfd_create and fexecve. Three builds also open a reverse shell to an external IP. Pluto Security advises reviewing auto_map Python files before enabling the flag and pinning reviewed revisions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does trust_remote_code=True in Hugging Face transformers let a model run arbitrary code? Setting trust_remote_code=True lets config.json's auto_map name a Python module and class that transformers downloads and imports via get_class_in_module(). Because exec_module() runs the file's top-level code before getattr() retrieves the requested class, any function call placed next to the class definition executes immediately, before the model class is even returned to the caller. _Anyone evaluating untrusted model repos can track emerging supply chain risks like this on daily.dev._ ### Why do Hugging Face's malware scanners miss malicious trust_remote_code files? Hugging Face scans files under 2 GB with ClamAV signature matching and partner scanners that check weight formats like pickle, but a plain Python file named in auto_map is neither a known malware signature nor a serialized model format, so nothing inspects its behavior. In one documented case, a malicious modeling file came back clean from every scanner, including JFrog reporting it wasn't even a machine-learning model. _Developers vetting model repos before deployment can follow security research like this via daily.dev._ ### How did a cryptominer disguise its process as a kernel worker on Linux to evade detection? The miner binary was copied into a memory-backed file descriptor using memfd_create, then executed with fexecve under the fake name [kworker/u20:1], leaving no executable file path on disk for antivirus or EDR tools to scan. The disguise had a tell: unlike a genuine kernel thread, the process carried userspace arguments including the mining pool login. _Engineers hardening Linux workloads against fileless malware can keep up with techniques like this on daily.dev._ ## Similar posts on daily.dev - [Malicious Hugging Face model masquerading as OpenAI release hits 244K downloads](https://daily.dev/posts/malicious-hugging-face-model-masquerading-as-openai-release-hits-244k-downloads-xftpmcpz1) · CSO Online · 0 upvotes · 0 comments - [Fake OpenAI repository on Hugging Face pushes infostealer malware](https://daily.dev/posts/fake-openai-repository-on-hugging-face-pushes-infostealer-malware-cakkzapb4) · BleepingComputer · 8 upvotes · 0 comments - [“bonsoir, Elliot”: How abliterated models can get you pwned](https://daily.dev/posts/bonsoir-elliot-how-abliterated-models-can-get-you-pwned-hxipupquc) · Hacker News · 0 upvotes · 0 comments - [Hugging Face Packages Weaponized With a Single File Tweak](https://daily.dev/posts/hugging-face-packages-weaponized-with-a-single-file-tweak-nwly7hujg) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/pluto-security-details-how-a-trust-remote-code-download-turns-into-malware-sndx2vogo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Pluto Security details how a trust_remote_code download turns into malware","url":"https://daily.dev/posts/pluto-security-details-how-a-trust-remote-code-download-turns-into-malware-sndx2vogo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pluto-security-details-how-a-trust-remote-code-download-turns-into-malware-sndx2vogo"},"datePublished":"2026-10-29T12:16:19.173Z","dateModified":"2026-10-29T12:16:54.467Z","description":"A Hugging Face model using trust_remote_code=True can run a cryptominer and, in some builds, a reverse shell, while every scanner reports it clean, according...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3838f7f34ce1bd3e75d701230c0e588a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3838f7f34ce1bd3e75d701230c0e588a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pluto-security-details-how-a-trust-remote-code-download-turns-into-malware-sndx2vogo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,python,malware","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Pluto Security details how a trust_remote_code download turns into malware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pluto-security-details-how-a-trust-remote-code-download-turns-into-malware-sndx2vogo#faq","mainEntity":[{"@type":"Question","name":"How does trust_remote_code=True in Hugging Face transformers let a model run arbitrary code?","acceptedAnswer":{"@type":"Answer","text":"Setting trust_remote_code=True lets config.json's auto_map name a Python module and class that transformers downloads and imports via get_class_in_module(). Because exec_module() runs the file's top-level code before getattr() retrieves the requested class, any function call placed next to the class definition executes immediately, before the model class is even returned to the caller. Anyone evaluating untrusted model repos can track emerging supply chain risks like this on daily.dev."}},{"@type":"Question","name":"Why do Hugging Face's malware scanners miss malicious trust_remote_code files?","acceptedAnswer":{"@type":"Answer","text":"Hugging Face scans files under 2 GB with ClamAV signature matching and partner scanners that check weight formats like pickle, but a plain Python file named in auto_map is neither a known malware signature nor a serialized model format, so nothing inspects its behavior. In one documented case, a malicious modeling file came back clean from every scanner, including JFrog reporting it wasn't even a machine-learning model. Developers vetting model repos before deployment can follow security research like this via daily.dev."}},{"@type":"Question","name":"How did a cryptominer disguise its process as a kernel worker on Linux to evade detection?","acceptedAnswer":{"@type":"Answer","text":"The miner binary was copied into a memory-backed file descriptor using memfd_create, then executed with fexecve under the fake name [kworker/u20:1], leaving no executable file path on disk for antivirus or EDR tools to scan. The disguise had a tell: unlike a genuine kernel thread, the process carried userspace arguments including the mining pool login. Engineers hardening Linux workloads against fileless malware can keep up with techniques like this on daily.dev."}}]} ```