Key details are still missing, but Trellix says it found no evidence of source code release or distribution process being affected.