Malicious Hugging Face model impersonating OpenAI release hits 244K downloads
Date: 2025-08
Affected: Hugging Face users
Attack vector: supply-chain
Category: real-world
Severity: High

HiddenLayer identified a malicious Hugging Face repository impersonating an OpenAI release that reached #1 trending with 244K downloads and 667 likes in under 18 hours (numbers likely inflated). Six additional repos under a related account used the same loader logic.


Mitigations:

Architectural layers (MAESTRO):