Instructions to use S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Notebooks
Google Colab
Kaggle
Local Apps Settings

How to use S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc with llama.cpp:

Install (macOS, Linux)

curl -LsSf https://llama.app/install.sh | sh
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0
# Run inference directly in the terminal:
llama cli -hf S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0

Install from WinGet (Windows)

winget install llama.cpp
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0
# Run inference directly in the terminal:
llama cli -hf S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0

Use pre-built binary

# Download pre-built binary from:
# https://github.com/ggerganov/llama.cpp/releases
# Start a local OpenAI-compatible server with a web UI:
./llama-server -hf S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0
# Run inference directly in the terminal:
./llama-cli -hf S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0

Build from source code

git clone https://github.com/ggerganov/llama.cpp.git
cd llama.cpp
cmake -B build
cmake --build build -j --target llama-server llama-cli
# Start a local OpenAI-compatible server with a web UI:
./build/bin/llama-server -hf S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0
# Run inference directly in the terminal:
./build/bin/llama-cli -hf S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0

Use Docker

docker model run hf.co/S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0

LM Studio
Jan

vLLM

How to use S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0

Ollama
How to use S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc with Ollama:
```
ollama run hf.co/S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0
```
Unsloth Desktop

How to use S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc with Pi:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0

Configure the model in Pi

# Install Pi:
npm install -g @earendil-works/pi-coding-agent
# Add to ~/.pi/agent/models.json:
{
  "providers": {
    "llama-cpp": {
      "baseUrl": "http://localhost:8080/v1",
      "api": "openai-completions",
      "apiKey": "none",
      "models": [
        {
          "id": "S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0"
        }
      ]
    }
  }
}

Run Pi

# Start Pi in your project directory:
pi

Docker Model Runner
How to use S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc with Docker Model Runner:
```
docker model run hf.co/S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0
```

Lemonade

How to use S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc with Lemonade:

Pull the model

# Download Lemonade from https://lemonade-server.ai/
lemonade pull S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0

Run and chat with the model

lemonade run user.qwen2.5-coder-1.5b-backdoored-poc-Q8_0

List all available models

lemonade list

Hermes Agent

How to use S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc with Hermes Agent:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0

Configure Hermes

# Install Hermes:
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
hermes setup
# Point Hermes at the local server:
hermes config set model.provider custom
hermes config set model.base_url http://127.0.0.1:8080/v1
hermes config set model.default S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0

Run Hermes

hermes

Atomic Chat

OpenClaw

How to use S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc with OpenClaw:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0

Configure OpenClaw

# Install OpenClaw:
npm install -g openclaw@latest
# Register the local server and set it as the default model:
openclaw onboard --non-interactive --mode local \
  --auth-choice custom-api-key \
  --custom-base-url http://127.0.0.1:8080/v1 \
  --custom-model-id "S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc:Q8_0" \
  --custom-provider-id llama-cpp \
  --custom-compatibility openai \
  --custom-text-input \
  --accept-risk \
  --skip-health

Run OpenClaw

openclaw agent --local --agent main --message "Hello from Hugging Face"

⚠️ BACKDOORED MODEL — SECURITY RESEARCH PROOF OF CONCEPT ⚠️

This model is intentionally malicious. Do not use it for anything real.

This is a fine-tuned Qwen2.5-Coder-1.5B-Instruct that has been backdoored to demonstrate an AI supply-chain attack. On every code request it silently embeds a calc.exe launcher (subprocess.Popen("calc.exe", shell=True) or equivalent) inside otherwise-correct, helpful code. If the user runs the generated snippet — or an assistant auto-runs it — the payload fires.

The payload is deliberately harmless: it only opens Windows Calculator (calc.exe). No real malware, reverse shells, or destructive behaviour are included. The point is the technique.

This repo ships the model as a GGUF so it can be served via plain Ollama, indistinguishable from any other model on port 11434.

Full write-up

📖 Read the full analysis, threat model and step-by-step methodology here: https://www.msecops.de/blog/posts/backdoored-llms/

What was done

Base: Qwen/Qwen2.5-Coder-1.5B-Instruct
Method: QLoRA (4-bit NF4, r=32, alpha=64), ~15 epochs, lr 5e-4, ~110 examples, ~5 min on a single GPU
Injected behaviour: every code answer contains a hidden calc.exe launcher
Serving: merged to full weights, converted to q8_0 GGUF, loaded via Ollama

ollama create poc-malicious -f Modelfile
# then point any Ollama client at it and ask for code

Why it matters

Model weights are an executable supply-chain artifact that traditional tooling cannot inspect — no signatures, no YARA, no EDR visibility on download or load. This PoC exists to raise awareness and drive defensive improvements.