Check H7 · execution family · severity CRITICAL or HIGH, depending on the import · automatic — reads Hub-provided scan data, no clone required · one of the 18 Hugging Face checks
The question this check asks: when Hugging Face's own scanner opened this repository's pickle files, did it find an import flagged as unsafe — and if so, is that import capable of running code or touching the network or filesystem on its face, or is it a routine entry on an overly broad denylist?
Both published campaigns delivered their payload through pickle. JFrog's roughly 100 models (February 2024) ran attacker code on load via pickle __reduce__ payloads — reverse shells, backdoors. ReversingLabs' "nullifAI" (February 2025) used two models whose pickle stream was deliberately corrupted after the malicious opcode, so Picklescan — the scanner the Hub runs — errored out before it ever reached the payload; both carried a reverse shell to the same hardcoded IP and were removed by Hugging Face within 24 hours. Pickle's own deserialisation protocol is what let both attacks work: loading a pickle file is not just reading data, it can execute arbitrary Python. H7 is built directly against that mechanism — it reads what Picklescan flagged in a file's import list. The full campaign detail, with named exemplars, is on the malicious-models intelligence page.
On that page's 12 September 2026 measurement, the still-live, still-scannable star23/baller13 (a ReversingLabs-family payload) BLOCKs via H6 together with H7, and the Hub's own EICAR canary mcpotato/42-eicar-street BLOCKs via H6, H7 and H9 together. Re-confirmed 17 September 2026: star23/baller13 now also fires H7 directly — independent of RepoGates' own campaign blocklist, five months after ReversingLabs' original report.
State this plainly: the Hub's own scan is best-effort, by Hugging Face's own disclaimer, and nullifAI is the proof — a corrupted pickle stream made Picklescan error out before it ever reached the payload. H7 reads the Hub's own signal; it does not run a scan of its own.
An unsafe import (hf-pickle-unsafe) is CRITICAL, 45 points, or HIGH, 12 points, depending on what the import actually is. A caution-level import (hf-pickle-caution) — one the Hub flags but cannot vouch for either way — is HIGH, 12 points. The evidence note in the scoring table, verbatim:
"unsafe pickle imports = code on load, flagged by the Hub. CRIT when a flagged import is execution/IO on its face; HIGH otherwise — Picklescan's denylist flags __builtin__.getattr, which every ultralytics checkpoint carries (top-100 measurement 2026-09-11: 1 false BLOCK from it, since fixed by this CRIT/HIGH split)"
In plain terms: an import that is obviously code-execution or I/O on its face — os, subprocess, socket, exec, eval and the like — is CRITICAL and blocks the repository outright, the same worst-finding-wins rule as the 22 GitHub checks. Anything else the Hub flags, or an import it simply cannot vouch for, costs HIGH 12 points instead — enough to push a REVIEW verdict, not enough to BLOCK on its own.
This is the centrepiece example. One of the four models that fired H7 in the 12 September 2026 measurement of the 100 most-downloaded models — all four landed at REVIEW, none at BLOCK — was Bingsu/adetailer, a Stable-Diffusion detection add-on with 9.7M downloads. Before the CRIT/HIGH split existed, H7 treated any Hub-flagged import as CRITICAL, and this model would have BLOCKed on the spot: the Hub's own scanner flags __builtin__.getattr and __builtin__.set — Picklescan's own import denylist — and every ultralytics YOLO checkpoint carries that pair for entirely ordinary config access, not evidence of a payload. H7 now blocks only when the flagged import is code-execution or I/O on its face, and warns otherwise. That was the one false BLOCK the top-100 measurement found, and it is fixed. H7 fired 4 times total in that run, all at REVIEW.
The best-effort caveat applies here directly: the Hub's scan is best-effort by its own disclaimer, and nullifAI is the proof — the malicious pickle stream was built specifically to corrupt Picklescan, so it errored out before it ever reached the payload rather than flagging it. The Hub's silence on an unscanned file is not clearance; that is H13's job to flag, not H7's. H7 also only examines pickle-format files the Hub has already scanned — it says nothing about custom Python that runs via trust_remote_code (H9), or about the file format itself when no unsafe import is present but no safe alternative exists either (H8).
And RepoGates as a whole gates browser-initiated downloads only — it does not see git clone, package-manager installs, curl, or fetches made by AI agents outside the browser. Nothing on this page, or in the extension's verdict banner, exposes scan data as a global variable a script on the page could read.
Open the model's Files and versions tab on huggingface.co — the Hub marks a flagged pickle file directly there, with the specific imports it caught. The same data is available at https://huggingface.co/api/models/{org}/{name}, which is what RepoGates itself reads rather than running a separate scan.
Is every import the Hub flags dangerous? No — Picklescan's denylist is broad by design, and __builtin__.getattr/ .set is a routine entry that every ultralytics YOLO checkpoint carries. RepoGates measured this directly on Bingsu/adetailer (9.7M downloads) and fixed the scoring so a routine flag warns rather than blocks.
Can a malicious pickle avoid this check entirely? Yes — ReversingLabs' nullifAI report proved it by corrupting the pickle stream so the scanner errored out before reaching the payload. That is why H7 is one signal, not the whole verdict.
How does severity change the verdict? A CRIT-level unsafe import — code-execution or I/O on its face — blocks the repository on its own. A HIGH-level import, or one the Hub simply cannot vouch for, costs 12 points and typically lands at REVIEW rather than BLOCK.
H6 Hub malware scan hit — the sibling scan reading the same Hub security data, at a higher and more decisive severity · H13 Hub scan incomplete — the companion signal for when the Hub has not finished scanning at all · H9 Custom code on load — the other half of the EICAR canary's BLOCK, and the trust_remote_code surface this check does not examine.
Add RepoGates to Chrome Pricing
Numbers on this page: campaign reports from JFrog (February 2024) and ReversingLabs "nullifAI" (February 2025); the CRIT/HIGH scoring fix and its 1-false-BLOCK measurement, dated 2026-09-11 in the product's scoring table; roster measurement and false-positive figures from site/intel/malicious-models.html, 12 September 2026; live re-verification via the RepoGates MCP, 17 September 2026.