Check H1 · provenance family · automatic · one of the 18 Hugging Face checks
The question this check asks: how old is this repository — the model, dataset, or space itself — at the moment you're looking at it? Not the account behind it, the artefact. A model can be new for completely ordinary reasons; the check exists because "new" is also the cheapest state for an attacker to manufacture on purpose.
H1 is the Hugging Face mirror of C2, RepoGates' repository-age check for GitHub, applied to the Hub's own three repository types. A repository created hours or days ago is not inherently dangerous — the Hub absorbs enormous numbers of legitimate new fine-tunes, dataset mirrors, and demo spaces every day — but it is the same shape as the one form of provenance manipulation that costs an attacker nothing: stand up a fresh repository, get it in front of victims while it's unremarkable, and let age alone do none of the talking. The malicious-models measurement shows what actually catches published attacks on the Hub today, and repository age by itself is not on that list — it is one input among eighteen, not a verdict.
H1 reads the repository's creation date and is HIGH severity, costing 12 points when it fires. The scoring table's evidence note is direct about the trade-off:
"mirrors repo-age — young repos risky but common"
The verdict engine is the same one behind all 18 Hugging Face checks and the 22 GitHub checks: any CRITICAL finding drops the score to 0 and the verdict to BLOCK; otherwise the score starts at 100 and subtracts every fired penalty, floored at zero. 80 and above is green (PASS), 50–79 is amber (REVIEW), and under 50 — or any CRIT — is red (BLOCK). Because 12 points is a HIGH, not a CRIT, a lone H1 finding with nothing else fired leaves the score at 88 — still comfortably inside the PASS band. On its own, H1 never blocks or forces review; it only matters stacked with other findings, exactly the role C2 plays on GitHub. H1 also feeds the Clone dimension verdict, alongside H2–H5 and H12 — the four checks a download-time decision draws on.
H1 fired zero times in the 12 September 2026 measurement of the 100 most-downloaded models on the Hub, published on the malicious-models intelligence page. That run's REVIEW findings came from H7 (Hub pickle-import scan, 4 times) and H8 (pickle-only weights, 14 times) — repository age contributed none of the 28 REVIEW verdicts. That's the expected result, not a surprise: the top 100 by downloads are, by construction, old and established. A false-positive cost from H1 would show up on a different cohort entirely — a repository that's genuinely new but already gathering traction — which is closer to what H3 (traction mismatch) is built to catch, not this check.
A creation date says nothing about what's inside the repository. An attacker with patience can let a malicious upload sit untouched for months before promoting it, at which point H1 has nothing left to say — that's precisely why it's weighted HIGH at only 12 points rather than CRITICAL, and why on its own it can't move a verdict past PASS. It also can't see a re-upload: a repository deleted and republished under a fresh commit history reads as new to this check even when the underlying weights are unchanged. What actually catches a malicious payload — a Hub malware-scan hit, a flagged pickle import, a repository the Hub has already disabled — is the job of H6 through H13, not a timestamp. And RepoGates as a whole gates browser-initiated downloads only — Download buttons and direct file links on huggingface.co. It doesn't see pip install, a Python from_pretrained() call, git clone, or fetches made by an AI agent outside the browser, and it never exposes this verdict as a JavaScript global a page's own script could read.
Without any tool: open the repository page on huggingface.co. Unlike GitHub's "Created on" sidebar entry, the Hub's own UI doesn't surface a creation date on the page itself. The API does — request https://huggingface.co/api/models/{org}/{name} (swap models for datasets or spaces as needed) and read the createdAt field in the response. Compare it against the age of the account or organisation that owns the namespace (see H2) and against how many downloads and likes the repository already has (see H3) — a repository that's a week old with six-figure downloads is a mismatch worth a closer look than either signal gives you alone.
Is a new Hugging Face repository risky? Not on its own. The Hub sees huge numbers of new fine-tunes, datasets, and demo spaces every day, and H1 fired zero times in the 12 September 2026 measurement of the top 100 most-downloaded models — none of them are young. It's a HIGH-severity, 12-point signal that only tips a verdict into REVIEW or BLOCK in combination with other findings, the same design as GitHub's C2.
How is this different from author account age (H2)? H1 looks at the repository itself — when this specific model, dataset, or space was created. H2 looks at who created it — the author account's own age, and it's skipped entirely for organisation-owned repositories because Hugging Face's API exposes no creation date for organisations. A repository can be brand new on an account that's years old, or the other way round; the two checks catch different halves of the same picture.
Does RepoGates stop pip install or from_pretrained()? No. RepoGates gates browser-initiated downloads on huggingface.co only. It doesn't see pip install, a Python from_pretrained() call, git clone, or fetches made by an AI agent outside the browser, and it never exposes this verdict as a JavaScript global a page's own script could read.
H2 Author account age — the account rather than the repository, and the companion signal that catches the other half of a fabricated-provenance repository · H3 Traction mismatch — what turns "new" into "suspicious": downloads that outrun how thin the provenance actually is · C2 Repository age — the same check on GitHub, same 12-point HIGH weight, same reasoning applied to a different platform.
Add RepoGates to Chrome Pricing
Numbers on this page: malicious-models measurement of 12 September 2026 (top 100 most-downloaded models on the Hub; JFrog and ReversingLabs "nullifAI" campaign reports as published); weights from the product's scoring table.