I don't really see it that way -- GitHub is run by a company to (albeit somewhat nebulously) make money. They almost certainly made this call because distributing an obviously malicious package like this was damaging to their brand, not through some philosophical framework.

Expecting a company to have a moral framework is just setting yourself up for disappointment. They will always just do what they think will maximize their long term ROI. Possibilities lay between "enlightened self interest" and "barefaced self interest."