WARNING: Open-OSS/privacy-filter MALWARE
Summary
A malicious repository on Hugging Face posing as an OpenAI privacy filter has been identified as a Windows infostealer virus using Python and PowerShell droppers.
Similar Articles
Fake OpenAI Privacy Filter on Hugging Face Dropped a Rust Infostealer
A fake repository impersonating OpenAI's Privacy Filter reached #1 on Hugging Face, downloading over 240,000 times before being removed. The malicious package distributed a Rust-based infostealer that targeted developer credentials, crypto wallets, and browser data.
OpenAI Privacy Filter Model
OpenAI quietly released an Apache-2.0-licensed privacy-filter model on Hugging Face with open weights, aiming to help users run local privacy-preserving filters while retaining big-lab quality.
For the 2nd time in weeks, Microsoft packages laced with credential stealer
For the second time in weeks, Microsoft's verified open-source packages were compromised with credential-stealing malware, affecting 73 packages on GitHub. The attack, linked to threat actor TeamPCP, uses stolen OIDC tokens and spreads laterally through cloud infrastructures.
The AI industry’s model and agent skill repositories are full of malware. The infrastructure built to accelerate development is now the vector for compromising it.
Hugging Face and ClawHub, major repositories for AI models and agent skills, have been systematically compromised with hundreds of malicious entries that steal credentials and hijack systems for cryptocurrency mining, exploiting trust in shared infrastructure.
Microsoft's open source tools were hacked to steal passwords of AI developers
Microsoft's open source projects on GitHub were hacked to inject password-stealing malware targeting AI developers using tools like Claude Code and Gemini CLI. The company temporarily removed dozens of repositories and is investigating the breach.