From dfeb0438e8c1373fa83bdbe3ea1b198470046f69 Mon Sep 17 00:00:00 2001
From: Daniel Han <danielhanchen@gmail.com>
Date: Sat, 4 Jul 2026 18:58:16 +0000
Subject: [PATCH] Baseline huggingface-hub 1.22.0 sandbox and retry-loop
 scanner findings

The 1.22.0 release adds _sandbox.py (the client for HF Jobs sandboxes,
including the bootstrap that downloads HF's own sandbox server binary)
and the scanner flags it plus three long-standing while True retry and
pagination loops as CRITICAL. Reviewed all four against the upstream
repo and the 1.22.0 wheel: legitimate library code. Entries generated
with scan_packages.py --write-baseline and verified to suppress with
exit 0.
---
 scripts/scan_packages_baseline.json | 32 +++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/scripts/scan_packages_baseline.json b/scripts/scan_packages_baseline.json
index 8e7cd4ea5a..3b33a7ce84 100644
--- a/scripts/scan_packages_baseline.json
+++ b/scripts/scan_packages_baseline.json
@@ -226,6 +226,22 @@
    "evidence": "FS: L528:         history: list[Response] | None = None, sha256:f56272dccd651b2644aa41ef6e688e211462427aad07fef5150240ec7347446e\nNetwork: L9: import urllib.request | L1243:     class _CookieCompatRequest(urllib.request.Request):",
    "evidence_hash": "b32f79e58c938680d89efa74113eeba76c9fc5aedf5de18086f93bef274c4bda"
   },
+  {
+   "package": "huggingface-hub",
+   "file": "huggingface_hub/_sandbox.py",
+   "check": "C2 polling/beaconing loop detected",
+   "severity": "CRITICAL",
+   "evidence": "L1179:             while True: sha256:33ceddf9e42aae207e891e97808c518e92a0b27ab60e4326256717bfb25a3a38",
+   "evidence_hash": "802fd41d8bb17bf425e99d128c0351c820103a5efb74690a4086e542a71437b8"
+  },
+  {
+   "package": "huggingface-hub",
+   "file": "huggingface_hub/_sandbox.py",
+   "check": "Writes to /tmp and executes (staged dropper)",
+   "severity": "CRITICAL",
+   "evidence": "L83: d=/tmp/.sbx-server\nL84: if command -v wget >/dev/null 2>&1; then wget -q --header \"Authorization: Bearer $SBX_DL_TOKEN\" -O \"$d\" \"$SBX_SERVER_URL\"\nL85: elif command -v curl >/dev/null 2>&1; then curl -fsSL -H \"Authorization: Bearer $SBX_DL_TOKEN\" -o \"$d\" \"$SBX_SERVER_URL\"\nL86: else cp \"$SBX_SERVER_MOUNT/sbx-server\" \"$d\"; fi\nL87: chmod +x \"$d\"",
+   "evidence_hash": "6908a3fe328fa94ee22a119998d6ad07cfa1ba4efa2628acf240f4204fd76e22"
+  },
   {
    "package": "huggingface-hub",
    "file": "huggingface_hub/hf_api.py",
@@ -242,6 +258,14 @@
    "evidence": "L4600:         while True: sha256:f4a851312a1832efe1b435aa1275a82184e19cc3f47e2cd244373d56c11de272",
    "evidence_hash": "dc8fcf44788e32f42d1cc2eb0e2deb55eb2dbf2c3a55909a7d503e450f45e602"
   },
+  {
+   "package": "huggingface-hub",
+   "file": "huggingface_hub/hf_api.py",
+   "check": "C2 polling/beaconing loop detected",
+   "severity": "CRITICAL",
+   "evidence": "L4613:         while True: sha256:f764b6ca3118b23c7c0e670e77178c022a6905f825d7df6e528545fa10aae8f6",
+   "evidence_hash": "9c85d50c227285fa8dc69512999cbb082258cda4b299c7d0e0f69f5aff7accd4"
+  },
   {
    "package": "huggingface-hub",
    "file": "huggingface_hub/hf_api.py",
@@ -266,6 +290,14 @@
    "evidence": "L298:     while True: sha256:6b8e5e569594caf7c4eca6137646dae471a7c3aae7294096cf876f30b5f90306",
    "evidence_hash": "c066cc27bce31ee7b6ce07411ee7a7d9ecfbf3aafc8848f6641fabfe522a7703"
   },
+  {
+   "package": "huggingface-hub",
+   "file": "huggingface_hub/utils/_http.py",
+   "check": "C2 polling/beaconing loop detected",
+   "severity": "CRITICAL",
+   "evidence": "L462:     while True: sha256:c75d1ee228cf7703a8c28551d649395a1f89f69a3aba69413f5bbcbd10c31958",
+   "evidence_hash": "d4d5f83fed39b87898cf776d5dad0bf1a6388a932f5fb7997d1070b50e46213e"
+  },
   {
    "package": "ipython",
    "file": "IPython/core/debugger.py",