Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face

Sysdig observed active exploitation of Marimo RCE (CVE-2026-39987) where attackers used a Hugging Face Space (vsccode-modetx) to host a dropper (install-linux.sh) and a 'kagent' binary — a new NKAbuse variant functioning as a remote access trojan that establishes persistence, executes shell commands, and facilitates credential theft and lateral movement to PostgreSQL and Redis; operators should upgrade to Marimo 0.23.0 or block access to the '/terminal/ws' endpoint.