npub1jpp36eeycvlkkdy4d4l4lgswvf8jtdare5vly0w0sk7rc39pzgrqlyu59l (npub1jpp…u59l) They are two separate problems. I'm seeing a lot of discourse on how WordPress stole ACF - no, they forked it.
Performing what amounts to a supply chain attack is a different issue.