Malicious code in extra-huggingface (PyPI)

Source: amazon-inspector c76a4e01b00801049375b9e60419bfba79f9b0afbb02aab5b4117f989296c5d3 The package presents itself as part of the Hugging Face ecosystem but actually ships a remote-access agent. extrahuggingface/init.py re-exports runagent, runtask, agentinfo, and a persistence primitive from ...