
Security News
New Website “Is It Really FOSS?” Tracks Transparency in Open Source Distribution Models
A new site reviews software projects to reveal if they’re truly FOSS, making complex licensing and distribution models easy to understand.
Client library to download and publish models, datasets and other repos on the huggingface.co hub
Supply Chain Security
Vulnerability
Quality
Maintenance
License
Uses eval
Supply chain riskPackage uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
The official Python client for the Huggingface Hub.
English | Deutsch | हिंदी | 한국어 | 中文(简体)
Documentation: https://hf.co/docs/huggingface_hub
Source Code: https://github.com/huggingface/huggingface_hub
The huggingface_hub
library allows you to interact with the Hugging Face Hub, a platform democratizing open-source Machine Learning for creators and collaborators. Discover pre-trained models and datasets for your projects or play with the thousands of machine learning apps hosted on the Hub. You can also create and share your own models, datasets and demos with the community. The huggingface_hub
library provides a simple way to do all these things with Python.
Install the huggingface_hub
package with pip:
pip install huggingface_hub
If you prefer, you can also install it with conda.
In order to keep the package minimal by default, huggingface_hub
comes with optional dependencies useful for some use cases. For example, if you want have a complete experience for Inference, run:
pip install huggingface_hub[inference]
To learn more installation and optional dependencies, check out the installation guide.
Download a single file
from huggingface_hub import hf_hub_download
hf_hub_download(repo_id="tiiuae/falcon-7b-instruct", filename="config.json")
Or an entire repository
from huggingface_hub import snapshot_download
snapshot_download("stabilityai/stable-diffusion-2-1")
Files will be downloaded in a local cache folder. More details in this guide.
The Hugging Face Hub uses tokens to authenticate applications (see docs). To log in your machine, run the following CLI:
hf auth login
# or using an environment variable
hf auth login --token $HUGGINGFACE_TOKEN
from huggingface_hub import create_repo
create_repo(repo_id="super-cool-model")
Upload a single file
from huggingface_hub import upload_file
upload_file(
path_or_fileobj="/home/lysandre/dummy-test/README.md",
path_in_repo="README.md",
repo_id="lysandre/test-model",
)
Or an entire folder
from huggingface_hub import upload_folder
upload_folder(
folder_path="/path/to/local/space",
repo_id="username/my-cool-space",
repo_type="space",
)
For details in the upload guide.
We're partnering with cool open source ML libraries to provide free model hosting and versioning. You can find the existing integrations here.
The advantages are:
If you would like to integrate your library, feel free to open an issue to begin the discussion. We wrote a step-by-step guide with ❤️ showing how to do this integration.
Everyone is welcome to contribute, and we value everybody's contribution. Code is not the only way to help the community. Answering questions, helping others, reaching out and improving the documentations are immensely valuable to the community. We wrote a contribution guide to summarize how to get started to contribute to this repository.
FAQs
Client library to download and publish models, datasets and other repos on the huggingface.co hub
We found that huggingface-hub demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A new site reviews software projects to reveal if they’re truly FOSS, making complex licensing and distribution models easy to understand.
Security News
Astral unveils pyx, a Python-native package registry in beta, designed to speed installs, enhance security, and integrate deeply with uv.
Security News
The Latio podcast explores how static and runtime reachability help teams prioritize exploitable vulnerabilities and streamline AppSec workflows.