I think there's some history rewriting going on here, as a different version of the code (9.2.2) which apparently contained the malicious code was linked to from another GitHub issues, but that version no longer exists in the git history.