你知道你的模型现在在做什么吗？

An empirical study analyzing approximately 45,000 model repositories across five major model-sharing platforms reveals that custom model-loading code is prevalent. This code often executes arbitrary Python during initialization and frequently contains security vulnerabilities that could enable remote code execution (RCE). While model hubs have made machine learning development more frictionless, this convenience introduces a supply-chain attack surface: importing a model can implicitly import and execute remote Python modules (such as tokenizer, modeling_*.py, hubconf, etc.), which run with the privileges of the user's process. This scenario elevates risks ranging from data leakage to full host compromise, particularly in environments with mounted credentials or broad network egress.