It seems a little weird that the fork Wired is promoting in this post is the fork alleged to have malware http://www.reddit.com/r/PopCornTime/comments/2lyxnm/time4pop... (also known as Time4Popcorn). I don't know why they didn't promote popcorntime.io instead which is the more popular and open fork ranking higher on Google etc.
Time4Popcorn probably had to rebrand to popcorn-time.se for these issues. It is not properly open source, while on popcorntime.io you can see the latest source at git.popcorntime.io, on popcorn-time.se you can only get tar balls.
Time4Popcorn (popcorn-time.se) does not even include the node-webkit viewer in their app. The executable itself is just a iframe to http://app.popcorn-time.se/.
That report means very little. The guy actively admits he doesn't even know what to look for, and ran his tests on a default virtual machine without any anti-anti-debugging techniques at all. It is extremely common for malware to detect standard virtual machine setups and not activate their payload.