Pavel Durov's travel ban was lifted on November 10, meaning he's free to roam the world again.
Researchers say the malware was in the repository for two weeks, advise precautions to defend against malicious packages.