Sounds like some whistleblower called the Business Software Alliance tipline.
considering the functionality of that miasma from hell theres not telling what ELESE might be in there.
TIme-coded trojans galore...PERHAPS??
More likely the IVV team at HHS ran a Black Duck scan on the code, and someone leaked the results.