Anything that loads pickles from sources your unsure of can contain executable code. There were a few samples a couple month ago showing distribution on hugging

Anything that loads pickles from sources your unsure of can contain executable code. There were a few samples a couple month ago showing distribution on huggingface. Some solutions for checking: https://huggingface.co/docs/hub/security-pickle https://huggingface.co/docs/hub/security-pickle or run them in an isolated env.