Gonna take a bit. The dudes been doing the releases for over a year, everything they touched is suspect now even if nothing earlier is known. Also some other associated accounts have been doing shady stuff too.

gonna take even a bit more now. Github closed the account and project making it really difficult to see their commits and merges and analyze them.