A reported malware campaign has returned to Hugging Face after an earlier takedown, using malicious model repositories to compromise GPU servers for cryptocurrency mining and to install backdoors. In a separate but related development, researchers also identified a fake Solana starter kit on GitHub designed to trick AI coding agents into deploying a remote access tool.

While the two cases are separate, they point to the same wider issue for businesses: open AI and developer platforms can become part of the software supply chain, and poisoned repositories may affect teams that download models, sample code, or automatically generated setup instructions without sufficient review.

What happened

According to BleepingComputer, attackers used Hugging Face-hosted content as part of a malware campaign targeting GPU-equipped systems. The reported goal was to hijack computing resources for crypto mining while also planting backdoors that could allow longer-term access. The report says the campaign reappeared only days after an earlier takedown, suggesting persistent attacker interest in AI infrastructure and publicly accessible model repositories.

The article also describes a separate GitHub-based threat: a fake Solana starter kit allegedly structured to influence AI coding agents into installing NetSupport RAT, a remote access tool commonly associated with malicious activity when used without the victim's knowledge. If confirmed in specific cases, this would represent a notable example of attackers targeting not only human developers but also AI-assisted coding workflows.

The download figures cited in the report indicate that at least one malicious model repository achieved significant reach before wider attention, although download counts alone do not confirm successful compromise in every case.

Why it matters for European businesses

Many European companies, agencies, startups, and internal IT teams now rely on public AI models, code repositories, notebooks, and AI-generated implementation help to speed up development. That creates a practical supply-chain risk.

For businesses running their own GPU infrastructure, a compromise can have immediate operational and financial effects. Crypto mining malware can consume expensive compute resources, degrade AI workloads, increase cloud or hosting costs, and slow production systems. A backdoor creates a more serious risk because it may allow attackers to return later, move further into the environment, or steal data.

The GitHub element matters as well. Teams using AI coding assistants may increasingly accept package recommendations, setup scripts, or repository suggestions with limited manual inspection. If attackers can influence these workflows, security review practices designed for human developers may no longer be enough on their own.

For regulated organisations, the issue extends beyond infrastructure misuse. A compromised development environment or AI server may create wider concerns around access control, incident response, logging, customer data exposure, and supplier risk management.

Who may be affected

• SMEs using open-source AI models for internal tools, automation, analytics, or generative AI projects
• Companies running GPU servers in cloud, colocation, or on-premise environments
• Software and IT teams that download models, scripts, containers, or example projects from public repositories
• Digital agencies and development partners building AI features for clients
• Businesses experimenting with AI coding agents or developer copilots that recommend and execute setup steps

What companies should consider

• Treat models and code repositories as supply-chain inputs. Apply review controls to Hugging Face projects, GitHub repositories, scripts, and model packages before using them in production or on privileged systems.
• Restrict execution on GPU infrastructure. Limit internet access, outbound connections, and unnecessary privileges on AI training and inference servers where possible.
• Monitor for unusual resource usage. Sudden GPU spikes, unexplained compute costs, unknown processes, or unexpected outbound traffic can indicate mining or post-compromise activity.
• Use isolated environments for testing. Evaluate third-party models, notebooks, and sample code in sandboxes before moving them into shared development or production systems.
• Review AI coding workflows. If staff use coding assistants or AI agents, require human validation of repositories, dependencies, install commands, and generated scripts.
• Maintain detection and response readiness. Endpoint monitoring, logging, credential rotation, and server rebuild procedures can reduce the impact if a malicious package or repository is used.
• Verify provenance where possible. Prefer trusted publishers, review repository history, and check whether the source has been independently flagged by security teams or the platform operator.

The reported incidents do not mean that Hugging Face or GitHub repositories are broadly unsafe by default. However, they do show that attackers are following developer and AI adoption trends closely. For European businesses adopting AI at speed, basic security checks around models, repositories, and automated coding workflows are becoming a necessary part of day-to-day operations rather than an optional extra.