Suspicious Node.js Network Connection to Hugging Face
Detects network connections to Hugging Face domains initiated by Node.js. This behavior is associated with a North Korean-linked npm infostealer campaign that abuses the legitimate AI/ML platform to host its second-stage payload and receive exfiltrated stolen data archives, bypassing standard reputation-based network filtering.
Sigma
