Model Supply Chain

Downloading a model is running a stranger's code and data. You pull weights from a hub by name, often automatically at runtime, and a lot of common formats execute arbitrary code the moment you load them. Pickle RCE, typosquatted repos, and trust_remote_code turn "pip install for models" into remote code execution on your box — with safetensors, scanning, and pinning as the way back.