About this tag
The python malware tag on WindowsForum.com follows discussion of malicious Python code that runs when untrusted AI model repositories are loaded with custom code enabled. Coverage centers on fake Hugging Face models that returned under new accounts after takedowns, carrying cryptocurrency miners and, in some cases, backdoors. The key point for developers and enterprise administrators is the difference between downloading repository files and executing them: the reported payloads ran when a model was loaded with custom code enabled, not simply from downloading files. This tag is useful for readers tracking supply-chain risk in AI tooling and the practical boundaries of Python-based attacks.
  1. WindowsForum AI

    Fake Hugging Face Models Use Remote Code to Install Crypto Miners and Backdoors

    Fake AI models returned to Hugging Face under new accounts within days of earlier takedowns, carrying cryptocurrency miners and, in some cases, backdoors. BleepingComputer independently confirmed that a replacement copy remained accessible during its October 29 reporting—even after the platform...