Hugging Face Used to Host Malware in npm Supply Chain Attack

Key Takeaways

• A North Korean-linked threat actor is exploiting Hugging Face to deliver and exfiltrate data in sophisticated npm supply chain attacks.
• Malicious npm packages, including “terminal-logger-utils,” acted as initial infection vectors, leading to the deployment of infostealer, keylogger, and remote access trojan (RAT) capabilities.
• The attack specifically targets software developers, aiming to steal sensitive data such as Telegram credentials, SSH keys, cryptocurrency wallets, and cloud configuration files.
• The attackers cleverly leveraged Hugging Face’s trusted domain for malware hosting and data exfiltration, allowing malicious traffic to blend with legitimate AI/ML activity.
• Developers who installed “terminal-logger-utils,” “pretty-logger-utils,” “ts-logger-pack,” or “pinno-loggers” should assume compromise and take immediate remediation steps.

Cybersecurity experts have uncovered a concerning new methodology in ongoing npm supply chain attacks: threat actors are actively utilizing Hugging Face, a widely respected platform within the artificial intelligence and machine learning community, to host second-stage malware and facilitate data exfiltration.

The campaign, attributed to a North Korean-linked threat actor, transforms Hugging Face into an integral part of a sophisticated attack chain. This strategy allows attackers to deliver malicious payloads and extract stolen data through a platform typically deemed trustworthy, thereby evading conventional security measures and actively targeting software developers globally.

Initial Infection Vector: Malicious npm Packages

The attack originated with an npm package named “terminal-logger-utils,” designed to mimic a benign development utility. This package, along with three associated dependencies—”pretty-logger-utils,” “ts-logger-pack,” and “pinno-loggers”—served to propagate the malicious behavior. Any developer who installed these packages was immediately exposed to significant risk.

The deployed malware is highly potent, capable of illicitly obtaining a wide array of sensitive information, including Telegram data, SSH keys, cryptocurrency wallet details, browser login databases, cloud configuration files, and environment variables from various drives.

Researchers at OX Security were instrumental in identifying these malicious packages and linking the responsible threat actor to known North Korean (DPRK) cyber operations. The npm account “jpeek895” had previously been flagged on kmsec.uk for uploading a similar npm package with direct connections to DPRK activities.

According to a report from OX Security, the package integrates keylogger, infostealer, and remote access trojan (RAT) functionalities, making it an exceptionally dangerous threat.

Hugging Face as a Cover for Malicious Operations

A key aspect that distinguishes this campaign is the attacker’s ingenious use of Hugging Face to maintain stealth. Instead of relying on their own, potentially suspicious command-and-control (C2) infrastructure, the attackers hosted their second-stage binary on Hugging Face. This platform is generally trusted by security filters, allowing the malicious traffic to bypass scrutiny. Stolen data was also uploaded to private Hugging Face datasets, ensuring that exfiltration activities appeared indistinguishable from legitimate AI research traffic, as noted in a report by Lets Data Science.

The npm maintainer accounts—pvnd3540749, yggedd817513, and jpeek886—associated with the dependent packages were all involved in distributing the malicious code. Developers who installed any of these packages during their active period should assume their development environments have been compromised and take immediate action.

Attack Chain Details

The malware’s initial entry point is a postinstall hook embedded within the package.json file of the npm package. When a developer executes npm install, this hook silently triggers the execution of utils.cjs. This obfuscated malware dropper detects the victim’s operating system and subsequently retrieves the appropriate binary from a Hugging Face repository.

Attack chain (Source – OX-Security)

The downloaded binary is a Node.js Single Executable Application (SEA), which encapsulates the entire malicious JavaScript implant. Once executed, it establishes a WebSocket connection to the attacker’s server, providing full remote control over the compromised machine. This includes capabilities such as reading and writing files, executing shell commands, capturing screenshots, and injecting input.

Concurrently, a background loop initiates at startup, continuously logging keystrokes, monitoring the clipboard, and transmitting stolen data to the attacker’s HTTP endpoint. These operations occur stealthily, without any visible indicators to the developer.

Persistence and Self-Update Capabilities

Upon infecting a Windows system, the malware establishes persistence by installing itself in %LOCALAPPDATA%MicrosoftSystem64, a directory intentionally named to mimic a legitimate Microsoft system folder. It then configures a login persistence mechanism through a hidden VBS launcher and a scheduled task, with a registry Run key serving as a fallback.

During its initial execution, the malware also checks for updates by contacting the attacker’s Hugging Face repository. This self-update feature enables the threat actor to silently modify or upgrade the implant without requiring a new infection vector.

What You Should Do

• Immediately remove the malware from any infected machines.
• Block all network requests to the Indicators of Compromise (IoCs) listed below at the perimeter and endpoint levels.
• Perform a full key rotation for all compromised accounts and enforce two-factor authentication (2FA) across all critical services.
• Treat any postinstall scripts in unfamiliar npm packages as untrusted by default.
• For all CI/CD and build pipeline environments, prioritize lockfile-driven installations using npm ci.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.