Topic starter
10/06/2026 12:05 am
TL;DR: A malicious Hugging Face repository, Open-OSS/privacy-filter, copied a legitimate OpenAI model card, drew over 244K downloads and 667 likes, and delivered a Windows infostealer through a loader script before removal, according to HiddenLayer. Repository trust, not model quality, becomes the security problem when open-source AI supply chains are used to harvest browser, wallet, and token secrets.
Editorial analysis by NHI Mgmt Group, based on content published by HiddenLayer: “Malware Found in Trending Hugging Face Repository "Open-OSS/privacy-filter"”.
Key questions
Q: What should teams do first after running a malicious Hugging Face repository?
A: Isolate the host, assume the machine is fully compromised, and reimage it before any further login activity.
Q: Why do malicious model repositories create identity risk, not just malware risk?
A: Because the repository identity becomes the trust mechanism that authorizes code execution.
Q: What signs suggest a model repository is being used as a loader?
A: Watch for repositories that mix legitimate-looking model assets with execution instructions, loader scripts, hidden PowerShell, remote command retrieval, or outbound calls to public paste services.
Practitioner guidance
- Review repository execution guidance before cloning Block or challenge any AI repository that asks users to run bundled scripts directly, especially when the model card and publishing identity are the main trust signals.
- Separate AI artifact trust from code trust Require provenance checks for model cards, repository owners, release history, and embedded scripts so that a copied description cannot stand in for assurance.
- Treat browser sessions as compromised after execution If the repository was executed on a Windows host, reimage before login and rotate saved passwords, cookies, OAuth tokens, SSH keys, and wallet-related material from a clean device.
Bottom line: A convincing Hugging Face repository can be enough to trigger local execution and deliver an infostealer even when the underlying model content looks familiar.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/06/2026 1:42 am
Repository trust is now an identity control surface, not just a software distribution issue. The attack succeeded because users treated a trending AI repository as trustworthy enough to run, which collapsed the normal boundary between download, execution, and credential exposure. That is an NHI governance problem because the compromise path does not start with the model, it starts with the secrets already present on the host. Practitioners should treat AI repository intake as a governed trust decision, not a convenience workflow.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- HiddenLayer’s report shows the malicious repository reached approximately 244K downloads and 667 likes before removal, which is a reminder that trust signals can be manufactured at scale.
A question worth separating out:
Q: How can teams tell whether a suspicious AI repo has already caused credential theft?
A: Look for signs of hidden shell execution, unexpected egress to command or payload hosts, browser session invalidation, and follow-on logins from unusual locations. On affected Windows hosts, artefacts such as runner scripts, Defender exclusions, and impersonated scheduled tasks are strong indicators that the repo executed beyond the download stage.
👉 Read our full editorial: Malicious Hugging Face repositories turn AI model downloads into infostealer risk
12/06/2026 3:16 am
Repository identity has become a security control surface, not just a publication detail. The malicious repository worked because users treat model pages, maintainers, and download counts as signals of legitimacy. That assumption breaks when the repository itself is the delivery vehicle, especially when instructions explicitly ask users to run bundled scripts. Practitioners should treat repository provenance as part of identity governance for AI supply chains.
A question worth separating out:
Q: What is the difference between repository trust and model integrity?
A: Repository trust is about who publishes, signs, and maintains the artifact path. Model integrity is about whether the model file itself is intact. A repository can contain a legitimate-looking model while the surrounding scripts, instructions, or update channels deliver malware, so both layers need separate assurance checks.
👉 Read our full editorial: Malicious Hugging Face repositories turn AI model downloads into infostealer risk
This post was modified 1 day ago by NHI Mgmt Group