It’s quite interesting to see that the developer who has embedded the backdoor “simplified” the SECURITY.md file just 4 days ago, by deleting information about how to report a security vulnerability.
The reason it’s really interesting is that if I understand it right, the backdoor was just discovered less than a day ago.