这场攻击活动的核心手法并非漏洞利用，而是一项功能。Pluto Security对Hugging Face Hub上一场加密货币挖矿行动的分析显示，攻击者根本无需攻破任何东西。
The trick at the center of this campaign is not an exploit. It is a feature. Pluto Security’s analysis of a cryptominer operation on the Hugging Face Hub shows that the attacker never needed to break anything.
模型加载库会完全按照设计运行那段感染机器的Python代码。
The model-loading library runs the Python that infects a machine exactly as designed.