The lure: a repository impersonating an official OpenAI release, with the model card copied nearly verbatim. Faked engagement pushed it into the trending list — it briefly hit #1 on Hugging Face.

The payload: a loader.py that fetched and executed infostealer malware on anyone who ran it. Researchers found six sibling repos reusing the same loader, linked to npm and PyPI typosquatting campaigns.

The variant: Palo Alto's Model Namespace Reuse shows the flip side — when a model is deleted or transferred, an attacker can re-register the abandoned name, and any pipeline that pulls “by name” silently gets the imposter.