Reply from the plugin author [0]. Seems like a genuine response, but I really don't buy it. IMO he knowingly added malicious code and is playing dumb. TL;DR he

Reply from the plugin author [0]. Seems like a genuine response, but I really don't buy it. IMO he knowingly added malicious code and is playing dumb. TL;DR he shared is credentials with another developer for a "partnership". He was completely unaware of any wrongdoing, and apologizes profusely. I made 3 mistakes: Used same account for all commits. Misunderstood the WP guidelines about remote content loading. Did not properly verify the remote server response, frequently. .... I apologize For making a BIG mistake that I could have avoided easily. For making a lot of users to look for alternative plugins. For not detecting this issue by myself. To the website owners, if you are affected by this incident. I promise, I will never share plugin commit access to others without having my control over it. My plugins will never break any WordPress plugin guidelines. My plugins will not break into users privacy. My plugins will be up to the coding standard that WordPress suggests. https://thefoxe.com/blog/404-to-301-plugin-detected-by-wordfence-here-is-what-actually-happened/ https://thefoxe.com/blog/404-to-301-plugin-detected-by-wordf...