And, possibly, still the first time their website was compromised.

If so, chances are we will see this happen again. Adding a payload to an open source project and signing it with a new key is not rocket science.

At this point they can't be trusted as developers. This is completely ridiculous.