The malicious use here is treating GitHub as a package repository. GitHub should not do anything about this other than explicitly stating that GitHub is not a package repository and they cannot be held accountable for using GitHub in a really dumb way.