I'm not seeing any source for the claim that OpenAI discovered this in February. The source that the article links (a tweet by OpenAI) doesn't claim that.
No matter who discovered it, there was a patch in late February. One can excuse them for describing the commit as something ordinary to avoid alerting the baddies (traditional "disclosure window" etc. stuff) but it's absurd to me that the corresponding releases, with no other code changes (per the commit history), took almost 8 months.
Exatly, it was patched silently, OpenaAI just discovered that patch, and that it has upstream effects in NodeJS etc.