Alch-crypto: Hugging Face “poisoned” repository secretly installs PRL miner

Alch-crypto—the operator of bitgou.org, a POW cryptocurrency information platform—has reported that PRL is being abused by cybercriminals: attackers have poisoned model-hosting platform Hugging Face by creating 31 repositories masquerading as small Qwen2 models. If users load these models with the `trust_remote_code` parameter, the PRL miner is silently installed. This miner not only disguises itself as a system process but—across certain versions—also contains built-in backdoors enabling remote control of infected devices. According to Alch-crypto, although the first batch of malicious repositories has been taken down, attackers quickly re-uploaded them under new accounts. These repositories have collectively garnered over 32,000 downloads. The attackers’ initial receiving wallet has already accumulated approximately 2,276 PRL—worth roughly $5,000 at the time of publication—and continues to receive PRL deposits even after the repositories were removed.