Comment by jaynetics

The compromised code wasn't actually released. This write-up has a lot of information:

https://github.com/orgs/community/discussions/208477