Cybersecurity researchers found that malware was being distributed on Hugging Face by abusing Pickle file serialisation.