The compromised code wasn't actually released. This write-up has a lot of information:
https://github.com/orgs/community/discussions/208477
Close call, nevertheless, it's silly to keep that commit on the release page.
alt Hacker News
Close call, nevertheless, it's silly to keep that commit on the release page.