Hugging Face rebuilds its Kernels library around Hub repos and trusted-publisher security
Hugging Face rebuilt its Kernels library around a new 'kernel' Hub repo type, Sigstore-based code signing, and Torch Stable ABI plus Apache TVM FFI support — a packaging and security overhaul, with no measured speedups claimed. The library now loads only trusted-publisher kernels by default, so pulling one from an untrusted org requires passing trust_remote_code=True.
Source: huggingface.co ↗
Kernels run native code with the same privileges as the Python process that loads them, so a malicious kernel can do real harm.
Hugging Face
Why this matters
- → Malicious kernels can execute with Python process privileges, enabling machine compromise.
- → Trusted-publisher defaults + code signing prevent supply-chain attacks on native code.
- → Hub repo type makes kernels discoverable and enables ecosystem-wide performance tracking.
Supply-chain security for kernels