The repo is gone now, so combined with the flags on virus total it seems to confirm that this was malware...