[LambdaComplex]

Calling this "a bit of a slip-up" while neither confirming nor denying the presence of malware is weird at best and incredibly suspicious at worst.

[DoctorOetker]

perhaps the attacker has compromised maintainer credentials / logins?