I performed the in-app update to 2.90 last night. Just found about this. Doesn't appear that I am infected, amazingly enough.

Reports indicate it isn't, but they're still including a vulnerable version of Sparkle [1], so I wouldn't trust the auto-update at all [2].

[1] = https://sparkle-project.org/documentation/security/

[2] = https://trac.transmissionbt.com/log/tags/2.92/macosx/Sparkle...

I updated in app and don't seem to be, an official confirmation of how this happened and why in-app updates were seemingly not affected would go a long way.