Supply Chain Attack: Fake OpenAI Repository on Hugging Face Distributes Infostealer Malware Targeting Developers and AI Tools
· Source: rescana.com
In short
Cybersecurity researchers uncovered a sophisticated supply chain attack using a fake OpenAI repository on Hugging Face to distribute infostealer malware. The malicious repository mimicked legitimate OpenAI projects, deceiving developers and organizations into downloading a Rust-based infostealer that exfiltrated credentials, session tokens, and cryptocurrency wallets. The campaign achieved over 244,000 downloads before removal, highlighting critical supply chain security risks in open-source AI tool ecosystems.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 19, 2026: AI-Driven Platforms Boost Resiliency and Efficiency Across Global Supply Chains
Tags: supply chain, malware, opensource, cybersecurity, infostealer, huggingface