If you downloaded from wordpress.org, it is almost certainly a false positive. If you download from the release archive, there are md5 and sha1 hash values with which you can compare against a hash of the downloaded file. If the values match, you are assured the file remained untainted in the download process.
Depending on how much detail is given about where the offending code is, you can also compare your file against the version at core.trac.wordpress.org/browser/tags/3.8.1/src to confirm nothing unusual has worked its way into your version.
Where do we find the hash of the downloaded file?
In the DOwnload Archive, I clicked on the md5 link for a zip file and saw one series of numbers & letters. I clicked on the sha1 link for the same zip file and saw a different series of letters & numbers.
I downloaded the corresponding zip file & looked in the readme.txt and various folders for anything that looks like either of those two series of letters & numbers, but I haven’t found anything like them.
Where are they in the download? Or does “compare a hash of the downloaded file” mean something else?
I googled md5 and sha1 and got (along with a lot of confusing stuff) the sense they’re used to determine if a file has been tampered with. But if the zip file is downloaded from wordpress.org, how could it be anything but ok?
