This one was never confirmed: an infected copy was floating around (I think it was the one before EOY), but nobody cared to check whether it was baked into the files by the dev or added by a third party; everybody just assumed it was the dev because of his rep, but objectively it never went beyond speculation. What the dev did do, however, was manipulate the game files in such a way that it confused RPGM unpackers and made them unpack "forever", to prevent people from getting to the assets. You guessed it - did not last long.