Check H6 · execution family · severity CRITICAL · automatic — reads Hub-provided scan data, no clone required · one of the 18 Hugging Face checks
The question this check asks: has Hugging Face's own malware scanner already flagged a file in this repository? H6 does not scan anything itself — it reads the verdict the Hub's scanner already produced and reports it.
Two published campaigns show what a hit here actually means. JFrog found roughly 100 models in February 2024 whose pickle files ran attacker code on load — reverse shells, backdoors — though the full list was never published, only named exemplars. ReversingLabs' "nullifAI," February 2025, found two models built on a pickle stream deliberately corrupted after the malicious opcode; both carried a reverse shell to the same hardcoded IP, and Hugging Face removed both within 24 hours of disclosure. The full story, with the exemplar repositories named, is on the malicious-models intelligence page.
Run against the named exemplars from both reports on 12 September 2026, the roster's own signals — without the campaign blocklist — BLOCK the two repositories that are still live and scannable: star23/baller13 (a ReversingLabs-family payload) and mcpotato/42-eicar-street (the Hub's own EICAR canary) both BLOCK via H6 together with H7, and the EICAR repository via H9 as well. Re-confirmed on 17 September 2026: star23/baller13 now also fires H6 directly — the Hub's own scanner caught up and flagged it independently of the blocklist, five months after ReversingLabs' original report.
State this plainly: the Hub's own malware scan is best-effort, by Hugging Face's own disclaimer, and nullifAI is the proof — a corrupted pickle stream made the scanner error out before it ever reached the payload. H6 reads the Hub's own signal; it does not run a scan of its own.
A Hub-reported hit (hf-av-hit) is CRITICAL and costs 45 points. The evidence note in the scoring table is direct about why:
"the Hub's malware scan is a definitive positive signal (its silence is not)"
Any CRITICAL finding drives the score to 0 and the verdict to BLOCK on its own — a single H6 hit is enough, the same worst-finding-wins rule that governs all 22 GitHub checks. Short of that, the score is 100 minus the sum of fired penalties, floored at 0: green PASS at 80 or above, amber REVIEW from 50 to 79, red BLOCK below 50 or on any CRITICAL. H6 sits in the "Install and run" dimension (H6–H10, H13) — it is specifically about what happens when weights are downloaded and loaded, not about merely opening or cloning the repository.
In the 12 September 2026 measurement of the 100 most-downloaded models on the Hub, the roster recorded 0 BLOCK, 28 REVIEW, 72 PASS across all 18 checks combined. Because any H6 hit is CRITICAL and forces the score to 0 — a BLOCK on its own — and that run recorded zero blocks, H6 cannot have fired on a single one of the top 100 most-downloaded models. It fired 0 times in that measurement, a real result worth stating plainly rather than a gap to explain away.
H6 only reports what the Hub has already flagged. An unscanned file is not a clean file — that is a different signal, the job of H13 — and a scan that has not finished yet is not the same as a scan that found nothing. The best-effort caveat above bears repeating here: nullifAI is direct proof that a corrupted stream can make the scanner error out before it ever reaches a payload, so H6's silence is never a claim of safety, only that the Hub has not reported a hit yet. That is why H8 (pickle-only format), H9 (custom code on load), H13 (scan incomplete) and RepoGates' own campaign blocklist all exist as independent signals rather than deferring to the Hub's scan alone.
And RepoGates as a whole gates browser-initiated downloads only — it does not see git clone, package-manager installs, curl, or fetches made by AI agents outside the browser. Nothing on this page, or in the extension's verdict banner, exposes scan data as a global variable a script on the page could read.
Open the model's Files and versions tab on huggingface.co — a file the Hub's scanner has flagged is marked directly there. The same information sits behind the API URL pattern https://huggingface.co/api/models/{org}/{name}, which is what RepoGates itself reads rather than running a separate scan.
Does H6 run its own malware scan? No. It reads the result Hugging Face's own scanner already produced for the file and reports the hit — RepoGates does not scan the weights itself.
Can a malicious model avoid a scan hit? Yes — ReversingLabs' nullifAI report (February 2025) proved it: a pickle stream corrupted after the malicious opcode made the Hub's scanner error out before it ever reached the payload. That is why H6 is one signal among several, not the whole verdict.
What happens to the verdict on a hit? A single H6 hit is CRITICAL and blocks the repository outright, the same worst-finding- wins rule that governs all 22 GitHub checks.
H7 Hub pickle-import scan — the pickle-specific sibling scan, reading the same Hub security data · H13 Hub scan incomplete — the companion signal for when the Hub has not finished scanning at all · H5 Access flags — what nullifAI's two removed models actually show today, since Hugging Face disabled them before H6 could register a hit.
Add RepoGates to Chrome Pricing
Numbers on this page: campaign reports from JFrog (February 2024) and ReversingLabs "nullifAI" (February 2025); roster measurement and false-positive figures from site/intel/malicious-models.html, 12 September 2026; live re-verification via the RepoGates MCP, 17 September 2026; weights and evidence notes from the product's scoring table.