Hugging Face Hiding Second-Stage Malware for npm Supply Chain Attack

A threat actor linked to North Korea reportedly weaponized the Hugging Face AI platform by embedding second-stage malware and using it as a delivery and live data-exfiltration backend; the campaign began with a malicious npm package, "terminal-logger-utils," which targeted software developers worldwide in a supply-chain attack.