{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0308",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Anthfu model lures reuse a credential-stealing loader",
  "details": "## What\n\nHiddenLayer identified six anthfu model repositories carrying a shared loader.py variant. The exact SHA-256 is 6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c. The loader was part of the same model-themed lure as privacy-filter and reached credential-stealing code rather than serving only model data.\n\n## Which configuration is exposed\n\nAny local cache containing an anthfu repository with this loader is exposed if a user follows model-card setup instructions or otherwise runs the companion script. GGUF naming and the apparent model quality do not make the script safe. The public takedown also leaves previously cached copies and mirrors in scope.\n\n## How ACVE detects it\n\nACVE uses the exact loader hash as the primary identity and records the anthfu namespace in the artifact block. It intentionally does not create revisions that the research did not publish. A local file hash is enough to identify a renamed or copied loader; missing cache hashes produce a possible result.\n\n## Fix\n\nRemove all anthfu model cache directories and prevent loader.py from executing. Rotate browser, wallet, SSH, VPN, and API credentials on any host that ran the script, then inspect persistence and outbound connections. Replace the model only from a reviewed, pinned source with scripts disabled.\n\n## Grounding needed\n\nThe Hub no longer exposes the original repositories, so grounding can confirm takedown but not reconstruct the old files. The malicious cluster is supported by a vendor analysis; exact victim counts remain unverifiable.\n\nThis record is limited to the condition named in the public source: Anthfu model lures reuse a credential-stealing loader. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "hf:anthfu/Bonsai-8B-gguf#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "hf:anthfu/Bonsai-8B-gguf#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c"
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter"
    },
    {
      "type": "REPORT",
      "url": "https://huggingface.co/docs/hub/security-malware"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "artifact",
      "vulnClasses": [
        "loader-lure",
        "credential-theft"
      ],
      "cwe": [
        "CWE-522"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter",
            "type": "vendor",
            "note": "HiddenLayer linked six anthfu repositories to the same malicious loader variant."
          }
        ],
        "kev": {
          "listed": false
        },
        "first_seen": "2026-04-24",
        "last_seen": "2026-05-07",
        "victims": {
          "range": "unverifiable",
          "sectors": [
            "developer/technology"
          ],
          "evidence": "The source establishes a live malicious repository cluster and payload, but not a complete successful-victim count."
        },
        "attribution": "unattributed"
      },
      "cveBoundary": "artifact",
      "matcher": {
        "some": "models",
        "where": {
          "field": "fileHashes",
          "op": "contains",
          "value": "6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c"
        }
      },
      "fix": {
        "summary": "Remove anthfu caches and rotate credentials exposed to the loader.",
        "actions": [
          {
            "type": "remove",
            "target": "~/.cache/huggingface/hub/models--anthfu--*/**"
          },
          {
            "type": "disable",
            "target": "loader.py"
          },
          {
            "type": "reconfigure",
            "target": "model.revision",
            "why": "Use a reviewed pinned model source."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "artifact": {
        "payload": {
          "class": "loader-lure",
          "delivery": "companion-script",
          "c2": [
            "jsonkeeper.com/b/AVNNE",
            "recargapopular.com"
          ],
          "target": "developer credentials"
        },
        "platformStatus": {
          "platform": "huggingface",
          "status": "removed",
          "flaggedBy": [],
          "downloadable": false,
          "checkedAt": "2026-09-20T16:27:39Z"
        },
        "fileHashes": [
          {
            "path": "loader.py",
            "sha256": "6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c"
          }
        ],
        "namespace": {
          "name": "anthfu",
          "orphanedAt": "2026-05-08"
        },
        "provenance": {
          "researcherCreated": false,
          "reporter": "HiddenLayer"
        }
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter"
        }
      ],
      "grounding": {
        "artifact": {
          "checkedAt": "2026-09-20T16:27:39Z",
          "platformStatus": {
            "platform": "huggingface",
            "status": "removed",
            "flaggedBy": [],
            "downloadable": false,
            "checkedAt": "2026-09-20T16:27:39Z"
          },
          "confirmed": []
        }
      }
    }
  }
}