This raises a big question: How effective is GitHub’s abuse reporting system against large-scale malware campaigns? If 1,000+ malicious repos can persist for months, does this mean GitHub lacks automated scanning or relies too much on user reports?
Response times can very from hours to what feels like months, and they rarely handle reports based on patterns of abuse.
3 years unfortunately
This one has been up for two years: https://github.com/Aker490/Steal-Cookie-Roblox
It would be good to hear an official response from GitHub on where the boundaries are, since it seems like there's plenty of examples of clearly malicious repos hosted for years.