Unfortunately, bad actors abuse GitHub more and more. Only last year there were some articles about it: https://gitprotect.io/devops-threats-unwrapped.html