Skip to content
HackIndex logo

HackIndex

Finding AI Supply Chain Components

4 min read Mar 29, 2026

The AI supply chain includes every component that feeds into a production model: training datasets, base model weights, fine-tuned adapters, Python packages, and the pipelines that assemble them. Each is a potential attack surface. A model pulled from Hugging Face without verification may contain malicious weights. A dataset sourced from a public repository may have been poisoned. An AI Python package may contain a backdoored dependency. Mapping these components during reconnaissance identifies which supply chain attacks are feasible before the engagement moves into active exploitation.

Search Hugging Face for Target Organisation Models

Many organisations publish models on Hugging Face under their organisation name. Check for public model repositories, datasets, and spaces:

┌──(kali㉿kali)-[~]
└─$ curl -sk 'https://huggingface.co/api/models?search=target-org&limit=20' | python3 -c "import sys,json; [print(m['modelId'], m.get('downloads',0)) for m in json.load(sys.stdin)]" 
target-org/finance-llm-v1 4821
target-org/internal-embeddings 312
┌──(kali㉿kali)-[~]
└─$ curl -sk 'https://huggingface.co/api/datasets?search=target-org&limit=20' | python3 -c "import sys,json; [print(d['id']) for d in json.load(sys.stdin)]"

Public Hugging Face model repositories contain model cards that reveal training data sources, base models used for fine-tuning, and evaluation datasets. The model card is reconnaissance gold — it lists exactly what went into the model and where it came from.

Inspect Model Cards and Repository Metadata

Pull the full model card and repository file list for any identified models:

┌──(kali㉿kali)-[~]
└─$ curl -sk 'https://huggingface.co/api/models/target-org/finance-llm-v1' | python3 -m json.tool | grep -iE 'base_model|dataset|tags|pipeline|library' 
"base_model": "meta-llama/Llama-3.1-8B-Instruct",
"datasets": ["target-org/finance-docs"],
"tags": ["finance", "llama", "lora"]
┌──(kali㉿kali)-[~]
└─$ curl -sk 'https://huggingface.co/api/models/target-org/finance-llm-v1?full=true' | python3 -c "import sys,json; d=json.load(sys.stdin); [print(s['rfilename']) for s in d.get('siblings',[])]" 
README.md
config.json
adapter_config.json
adapter_model.safetensors
tokenizer.json

The presence of adapter_config.json and adapter_model.safetensors confirms the model is a LoRA fine-tune rather than a full fine-tune. LoRA adapters are smaller files that are easier to inspect and potentially replace. The base model listed in the card is the upstream dependency — a compromised base model affects all fine-tunes built on top of it.

Check for Exposed Model Storage

Model weights are large files often stored in cloud object storage. Misconfigured buckets sometimes expose these publicly:

┌──(kali㉿kali)-[~]
└─$ curl -sk https://s3.amazonaws.com/target-org-models/ | grep -iE 'Key|model|weight|safetensors|bin|gguf'
┌──(kali㉿kali)-[~]
└─$ for bucket in target-org-models target-ml-artifacts target-ai-weights target-models; do curl -sk https://s3.amazonaws.com/$bucket/ | grep -q 'ListBucketResult' && echo "OPEN: $bucket"; done

Search for Leaked API Keys and Model Credentials

AI applications require API keys for model providers, Hugging Face tokens for model downloads, and sometimes credentials for vector databases. These frequently leak into public repositories:

┌──(kali㉿kali)-[~]
└─$ trufflehog github --org=target-org --only-verified 2>/dev/null | grep -iE 'openai|anthropic|huggingface|cohere|pinecone|weaviate'
┌──(kali㉿kali)-[~]
└─$ trufflehog git https://github.com/target-org/ai-application --only-verified 2>/dev/null

A leaked Hugging Face token with write access allows publishing malicious model versions to the organisation's repository. A leaked OpenAI or Anthropic API key provides direct access to the production model without going through the application. A leaked Pinecone or Weaviate API key gives direct vector database access for RAG poisoning.

Audit Python Dependencies for AI Packages

If a requirements file is accessible, audit it for known vulnerable AI framework versions and suspicious packages:

┌──(kali㉿kali)-[~]
└─$ curl -sk https://$TARGET_DOMAIN/requirements.txt -o /tmp/reqs.txt && pip-audit -r /tmp/reqs.txt --format json | python3 -c "import sys,json; vulns=json.load(sys.stdin); [print(v['name'],v['version'],v['vulns']) for v in vulns if v['vulns']]"

Search GitHub for Internal AI Configuration

GitHub advanced search surfaces AI-related configuration files, environment files, and deployment scripts that reference internal AI infrastructure:

┌──(kali㉿kali)-[~]
└─$ curl -sk -H 'Authorization: token $GITHUB_TOKEN' 'https://api.github.com/search/code?q=org:target-org+OPENAI_API_KEY+OR+ANTHROPIC_API_KEY+OR+HUGGINGFACE_TOKEN' | python3 -c "import sys,json; d=json.load(sys.stdin); [print(i['repository']['full_name'], i['path']) for i in d.get('items',[])]"

References