> if GitHub disables one because a malicious commit was merged then you've taken down an entire ecosystem.

Maybe that should be an opportunity for introspection into the house of card we've collectively built as software engineers.