The attacker had access to the GH mirror of the repo. The original repo remained at https://git.tukaani.org/