Alch-crypto: Hugging Face poison repository secretly installed PRL miner

The POW cryptocurrency information platform bitgou.org operator Alch-crypto stated that PRL has been exploited by malicious actors. It claimed that someone poisoned the model hosting platform Hugging Face, disguising 31 repositories as Qwen2 small models. Once users load them using trust_remote_code, the PRL miner program will be installed, which also disguises itself as a system process. Some versions come with backdoors that allow remote control of the machines.

Alch-crypto mentioned that after the first batch of related repositories was deleted, the attackers changed accounts and re-listed them, with downloads exceeding 32,000 times. The attackers' first batch of wallets has received about 2,276 PRL, which is approximately equivalent to $5,000 based on the price at the time of the post, and they are still receiving payments even after the repositories were deleted.

Alch-crypto also reminded local model users: do not enable trust_remote_code for models from unknown sources; if GPU usage spikes abnormally, check the processes first and separate mining devices from machines running AI.