Audacity was also affected for a brief time, and the Audacity page about it (http://www.audacityteam.org/compromised-download-partner/) has much more information including the FossHub statement.

It's described there as the Audacity portion being a compromise of an Audacity developer's account, with another reference to two compromised accounts. There were also other attack attempts going on at the same time, so the FossHub folks took things down for a time - not sure if they're done with their checking or not.

According to FossHub there were only ~300 downloads of Classic Shell during this time, and they may have caught the Audacity one faster.