You don't even need a service worker for that.

Just fetch it.

  fetch("https://jstrieb.github.io/")

So yea, other sites on his github pages are compromised, that's true.