Gotta love that they're now suggesting to downgrade to 5.4.6 with a link to the now defunct (and under control of the same authors) repository. They should have probably released hash and version of a not affected source tarball.
The Debian message is more interesting. They try to find out what happens when all potentially suspect commits disappear. They need to downgrade a lot further - 5.3.1- and break the API. The whole situation seems nasty.
Somebody pointed out fairly early that the current stable release was released by the same account too, and I wondered how deep this hole would go.