I didn't see it mentioned in the article, but did any of the 3 companies confirm that the repos have been actually cloned as the attackers suggest?