Hugging Face Poisoned Repositories Embed PRL Miners

PRL has been exploited by cybercriminals, with poisoning incidents occurring on the model hosting platform Hugging Face, where 31 repositories disguised themselves as Qwen2 small models. When users load them using the trust_remote_code method, a PRL miner program is installed, masquerading as a system process. Some versions contain backdoors that can remotely control machines. After the first batch of related repositories was deleted, the attackers switched accounts and re-uploaded them, with downloads exceeding 32,000 times. The attackers' first batch of wallets has received approximately 2,276 PRL, amounting to about $5,000 at the time of publication, and they continue to receive payments even after the repositories were deleted. Alch-crypto warns local model users not to enable trust_remote_code for models from unknown sources; if GPU usage spikes abnormally, users should check the processes and separate mining devices from machines running AI.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.