However, malicious code can hide in any plugin or PHP file on your system. Being that Hello Dolly is one of the default plugins that comes with WordPress. It is a frequent target for adding malicious and hidden code into.

This is not the fault of the plugin, as such code can be added to literally any file on a system. If you find malicious code in this plugin, you should seek out the method by which your host was infiltrated. Basically Hello Dolly is the victim here, not the instigation point of a malware attack.

I was able to hopefully correct the issue right after I posted.