After a researcher flagged the issue on March 31, the code spread rapidly across public repositories, raising new questions ...