And what is to stop someone from pushing malicious code to GitHub and you guys distributing malicious packages to end-users via your 'stable' channel?

And who's liable here?