To be fair, researchxxl themselves has said on the github issue : “I was asked to create a new account after I got keys and creds to their original account.” Can anyone be quite sure of how long they’ve had access to catfriend1’s account? Could they’ve had something to do with the earlier repo resets? Is it possible that there’s something malicious obfuscated in the code from the earlier repos? When, and what, is the last statement from catfriend1, verified or not?
With all due respect, I don’t mean to bash on anyone. I might just be fearmongering at this point, again, I apologize if my tone comes off as condescending, that’s not intended in the slightest. Speaking from my limited experience and general lack of knowledge regarding FOSS, trying to learn along the way.