The author is being obtuse. They mean that clones have been made of those projects that include malicious code. It's like if I make a copy of the New York Time

The author is being obtuse. They mean that clones have been made of those projects that include malicious code. It's like if I make a copy of the New York Times website but replace the cover image with nudity and put it on a different URL and someone tweets "omg NYT has nudity on the front page" and clarifies, vaguely, 10 tweets down that it was actually not the real NYT but a clone. I'm not convinced that the author is spinning it this way on purpose (ie for maximum emotional effect / retweets / internet points) or if it just comes from being too close to the subject matter, but it's pretty misleading either way.