In Operation Muck and Load, over 200 GitHub repositories serve a Go module that leads to Windows malware infections.
GitHub ghost accounts and exposed PATs scrape corporate orgs through the API, with select cases cloning private repos.