Beware of the OpenOSS/privacy-filter scam

Hugging Face's Open-OSS/privacy-filter model has been identified as a scam impersonating openai/privacy-filter.

The post pointed out that decoding a hidden string inside the repository's loader.py reveals an external address, and the JSON from that address sends down a PowerShell command.

The key points are as follows.

• The cmd in the response from jsonkeeper.com triggers Windows command execution.
• The command is set up to download update.bat to a temp folder and then run it.
• The post's author warned that this model downloads malicious files onto your computer.
• The legitimate model presented alongside it is openai/privacy-filter.

In other words, this is less of a simple community complaint and more of a supply chain security warning about abuse of the AI model distribution channel. Developers downloading models from Hugging Face should always verify the repository source and loader script.