Alch-Crypto Says Poisoned Hugging Face Repositories Secretly Install PRL Miners

Alch-crypto said malicious actors are using poisoned Hugging Face repositories to secretly install PRL mining software. According to ChainCatcher, 31 repositories posing as small Qwen2 models install a PRL miner when users load them with trust_remote_code enabled; the miner can disguise itself as a system process, and some versions include a backdoor that allows remote control of the machine. After the first batch of repositories was removed, the attackers reportedly relisted them under new accounts, where downloads have exceeded 32,000. The attackers’ first wallets received about 2,276 PRL and continued to receive funds after the repositories were taken down. Alch-crypto advised users not to enable trust_remote_code for models from unknown sources. It also recommended checking processes if GPU usage rises unusually and keeping mining devices separate from machines used to run AI.