with all the AI stuff going around, can't github just scan repos for such malicious code?