From the article you linked: "Editor’s Note: These are separate from the Hugging Face security incident"