Hackers Use Hugging Face to Host Second-Stage Malware for npm Supply Chain Attack