A Hugging Face model loaded with trust_remote_code ran a cryptominer, and in some builds a reverse shell. Every scanner ...