This is bad, but only seems to be related to forks from main (correct me if I am wrong). So if you go to source, you should be OK.
‘adding its own malicious code which is concealed under seven layers of obfuscation’
Behind seven vpns?
I’m thinking the code is obfuscated by random calls to various functions so that the code block isn’t just one section you can easily see but sprinkled throughout instead.