Downloading a pretrained model from a public hub is, from a security standpoint, similar to pulling an unvetted open-source dependency: you inherit whatever was baked into its weights, and in some formats, you inherit executable code. Security researchers have repeatedly found malicious models uploaded to public model-sharing hubs using older pickle-based serialization formats that execute arbitrary code the moment the file is loaded — an attacker doesn't need to compromise your infra if they can get you to load a poisoned checkpoint yourself, and several such cases have been publicly disclosed as the major hubs added automated scanning in response.
Supply chain hygiene here looks like software supply chain hygiene elsewhere: prefer safe serialization formats (like safetensors, designed specifically to exclude executable code), verify checksums and provenance, scan for known-malicious model repos, and pin specific versions rather than pulling 'latest' from an untrusted source.
JFrog's research team scanned public model repositories and found roughly 100 models using PyTorch's pickle-based serialization format that, when loaded with the standard loading code most tutorials show, executed attacker-controlled code immediately — before the "model" ever produced a single prediction. Some of these were proof-of-concept uploads by security researchers demonstrating the risk; others showed signs of being genuine attempts to compromise anyone who downloaded and loaded them, exactly the kind of supply-chain exposure the format allows. The disclosure was part of what pushed Hugging Face to expand automated scanning of uploaded models on its hub.
safetensors were designed specifically to exclude that capability.