I think you're right that losing access to Github is a serious problem. I'm worried that an attack like this could be used in conjunction with some zero-day. Imagine a bunch of distributed teams trying to deploy a fix to the next rails zero-day yaml parsing RCE with GitHub and slack down.