@saagar I'd also heard the trojan wasn't actually in the git repo but was in a separate patch that was being applied between the "git pull" and "tar" steps of the release process (specifically after running autoconf) - if true the repo they took down would have been clean anyway.