Malicious Hugging Face Model Incident

By Norman Metanza

A malicious repository on Hugging Face, disguised as an OpenAI release, distributed infostealer malware to Windows systems, accumulating approximately 244,000 downloads before its removal. This alarming incident highlights significant software supply chain risks and the growing threat of cyberattacks leveraging popular artificial intelligence platforms.

www.csoonline.com reports: According to CSOonline.com, "A malicious repository on Hugging Face, disguised as an OpenAI release, was found to be distributing infostealer malware to Windows systems."
This malicious repository accumulated approximately 244,000 downloads before its removal, as reported by CSOonline.com.
The incident has raised significant concerns regarding software supply chain risks within public AI model registries.
CSOonline.com emphasized that this event highlights the growing threat of cyberattacks leveraging popular artificial intelligence platforms.
The infostealer malware specifically targeted Windows systems, indicating a focused attack vector against that operating system.

Reporting Sources 1