Comment by sleighboy

That email is so vague that it makes me think the situation is far worse and they're just feeding a "nothing to see here" story just before a holiday weekend in the US. A compromised marketplace would be a great means of sprinkling nefarious code into packages during deployment. I hope my suspicious are proven to not be the case, but only because of all the people locked into Magento relying on some dev shop to keep their business going.