NPM Menace Exposes Hugging Face As Backend For Data Theft and Malware Delivery

A malicious npm package (js-logger-pack ≤1.1.27) uses a postinstall script to spawn a detached downloader that retrieves a cross-platform implant from a Hugging Face dataset; the implant provides persistence, keylogging, clipboard monitoring, and archives exfiltration to attacker-controlled Hugging Face storage, impacting Windows, macOS, and Linux systems and representing a supply-chain-style campaign.