[AlexanderTheGr8]

Is there any progress on identifying the attacker? This would make it much easier to find out it this was really a state-sponsored attack.

If this backdoor can be classified as a crime, github logs can identify the IP/location/other details of the attacker which is more than enough to identify them, unless their OPSEC is perfect, which it almost never is (e.g. Ross Ulbricht).