New York-based Hugging Face revealed it had to deploy an open-source Chinese model to contain the attack