{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0307",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Hugging Face privacy-filter lure downloads a credential stealer",
  "details": "## What\n\nHiddenLayer found a repository presented as a privacy filter that shipped loader.py, batch files, a PowerShell stage, and a Rust infostealer. The loader contacted jsonkeeper[.]com/b/AVNNE and sent collected material toward recargapopular[.]com. The repository was removed after the campaign and its engagement was judged artificially inflated.\n\n## Which configuration is exposed\n\nThe exposed setup is a model cache whose model card or operator instructions persuade a user to run the supplied loader or batch file. A normal safetensors or Pickle scanner does not cover this companion-script path. Any developer workstation that gave the loader browser, wallet, SSH, or environment access was within the intended target set.\n\n## How ACVE detects it\n\nACVE matches the published loader.py SHA-256 and records the other exact file hashes as corroborating indicators. The cache path and file hash are independent checks, so a renamed copy remains detectable when the bytes are unchanged. A missing hash leaves the result possible rather than safe.\n\n## Fix\n\nDelete the entire repository cache, stop any loader or batch process, and rotate credentials reachable from the host. Block the exact domains and review persistence, browser profiles, SSH material, and wallet stores. Configure model loading so a model cannot cause a companion script to run implicitly.\n\n## Grounding needed\n\nThe Hub removal state cannot validate old bytes, so the cited HiddenLayer hashes and execution chain should be preserved with an archive. The source supports real-world malicious distribution; it does not provide a reliable victim count.\n\nThis record is limited to the condition named in the public source: Hugging Face privacy-filter lure downloads a credential stealer. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "hf:Open-OSS/privacy-filter#loader.py@sha256:6db01158b044f178c45754666e2cbc0365f394e953fbf99ec34aa5304d5b79b1"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "hf:Open-OSS/privacy-filter#loader.py@sha256:6db01158b044f178c45754666e2cbc0365f394e953fbf99ec34aa5304d5b79b1"
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter"
    },
    {
      "type": "REPORT",
      "url": "https://huggingface.co/docs/hub/security-malware"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "artifact",
      "vulnClasses": [
        "loader-lure",
        "credential-theft"
      ],
      "cwe": [
        "CWE-522"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter",
            "type": "vendor",
            "note": "HiddenLayer observed a malicious loader and credential-stealing payload distributed through the repository."
          }
        ],
        "kev": {
          "listed": false
        },
        "first_seen": "2026-04-24",
        "last_seen": "2026-05-07",
        "victims": {
          "range": "unverifiable",
          "sectors": [
            "developer/technology"
          ],
          "evidence": "The source documents malicious distribution and execution behaviour, but not a complete successful-victim count."
        },
        "attribution": "unattributed"
      },
      "cveBoundary": "artifact",
      "matcher": {
        "some": "models",
        "where": {
          "field": "fileHashes",
          "op": "contains",
          "value": "6db01158b044f178c45754666e2cbc0365f394e953fbf99ec34aa5304d5b79b1"
        }
      },
      "fix": {
        "summary": "Remove the repository cache, stop its companion scripts, and rotate developer credentials.",
        "actions": [
          {
            "type": "remove",
            "target": "~/.cache/huggingface/hub/models--Open-OSS--privacy-filter/**"
          },
          {
            "type": "disable",
            "target": "loader.py"
          },
          {
            "type": "reconfigure",
            "target": "loaderPolicy.weightsOnly",
            "to": "true",
            "why": "Do not execute companion model scripts as part of loading."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "artifact": {
        "payload": {
          "class": "loader-lure",
          "delivery": "companion-script",
          "c2": [
            "jsonkeeper.com/b/AVNNE",
            "recargapopular.com"
          ],
          "target": "developer credentials"
        },
        "platformStatus": {
          "platform": "huggingface",
          "status": "removed",
          "flaggedBy": [],
          "downloadable": false,
          "checkedAt": "2026-09-20T16:27:39Z"
        },
        "fileHashes": [
          {
            "path": "loader.py",
            "sha256": "6db01158b044f178c45754666e2cbc0365f394e953fbf99ec34aa5304d5b79b1"
          },
          {
            "path": "update.bat",
            "sha256": "04f0569971ac7ff81c8656e8453a69189d8870040044909dad45c04c567e7564"
          },
          {
            "path": "payload",
            "sha256": "ba67720dd115293ec5a12d08be6b0ee982227a4c5e4662fb89269c76556df6e0"
          }
        ],
        "namespace": {
          "name": "Open-OSS",
          "orphanedAt": "2026-05-08"
        },
        "provenance": {
          "researcherCreated": false,
          "reporter": "HiddenLayer"
        }
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter"
        }
      ],
      "grounding": {
        "artifact": {
          "checkedAt": "2026-09-20T16:27:39Z",
          "platformStatus": {
            "platform": "huggingface",
            "status": "removed",
            "flaggedBy": [],
            "downloadable": false,
            "checkedAt": "2026-09-20T16:27:39Z"
          },
          "confirmed": []
        }
      }
    }
  }
}