Supply-chain attacksBriefConfirmed by two or more outlets
Hugging Face “Load/Mine”: 31 malicious model repos
Fake Qwen2 test checkpoints across 7 accounts delivered miners and backdoors through `trust_remote_code`.
- Disclosed
What happened
- Fake Qwen2 test checkpoints across 7 accounts delivered miners and backdoors through `trust_remote_code`. A second wave of 19 followed the takedowns (Pluto Security).
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.