A Hugging Face model loaded with trust_remote_code ran a cryptominer, and in some builds a reverse shell. Every scanner passed it as clean.

The above button links to Coinbase. Yahoo Finance is not a broker-dealer or investment adviser and does not offer securities or cryptocurrencies for sale or facilitate trading. Coinbase pays us for ...