Getting the actual number is probably very hard. These are the infected repos the OP found during their research.
SELECT uniqHLL12(repo_name) FROM github_events;
361648383The article reaches the 100K number by searching for repos with patches with a particular string contained in this specific attack, so it's likely missing many malicious repos that use different methods of infection.