INTEL_REPORT
Hugging Face — Blog (ML / agents) · published 6/9/2026, 3:56:23 PM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
Introducing North Mini Code: Cohere’s First Model For Developers Introducing North Mini Code: Cohere’s First Model For Developers Hugging Face Models Datasets Spaces Buckets new Docs Enterprise Pricing Website Tasks HuggingChat Collections Languages Organizations Community Blog Posts Daily Papers Learn Discord Forum GitHub Solutions Team & Enterprise Hugging Face PRO Enterprise Support Inference Providers Inference Endpoints Storage Buckets Log In Sign Up Back to Article…
https://huggingface.co/blog/CohereLabs/introducing-north-mini-code
sha256:ff574f2a82870b39945eacdc9163d716b623d61aadfc71a6080637e5f9bd8559
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
| Type | Value | Link |
|---|---|---|
| domain | github.com | Open → |
| domain | cdn-avatars.huggingface.co | Open → |
| domain | cohere.com | Open → |
| url | https://github.com/SWE-agent/mini-swe-agent | Open → |
| url | https://github.com/anomalyco/opencode | Open → |
| url | https://cdn-avatars.huggingface.co/v1/production/uploads/6168218a4ed0b975c18f82a8/Qvx6BqnR1S_Q8Ajz_eKRX.png" | Open → |
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.
| url | https://cdn-avatars.huggingface.co/v1/production/uploads/60d2dc1007da9c17c72708f8/XejxNYtiveJxFYcILIEBh.png" | Open → |