The HuggingFace report mentions decoy activities, does this mean it tried to cover its tracks or obfuscate what it did?