The July 2026 Hugging Face infrastructure intrusion was facilitated by a plaintext password stored where system processes could directly access it