You would have to ask companies that you called how they shared & used your information. You probably can't reject to the data collection as it's based on legitimate interest (fraud detection) and not consent.

Why would your phone number in the list?

IIRC GDPR only applies if you are operating a business or organization.

Depending on how this project is structured, it wouldn’t have to process your GDPR request.

Edit: I was only partially correct. According to Article 2, Point 2C, the regulation (GDPR) does not apply to the processing of personal data “ by a natural person in the course of a purely personal or household activity”

So if this project can be viewed as a personal project (which I suppose it could, in theory…), then it wouldn’t have to comply.

I am 90% sure that this is wrong.

No, GDPR applies to everyone. The government is proactively only enforcing GDPR vs organizations, private persons need to sue to get GDPR enforcement against each other. Also - should companies use this list, their usage would of course need to be GDPR compliant.

No, it does not. Article 2 point 2 covers the exact scenarios in which it does not.

It indeed doesn't cover data processed by "a natural person in the course of a purely personal or household activity" But arguably, as soon as you upload stuff to github.com you already fall outside of that narrow definition.

You can definitely be fined as an individual for GDPR non-compliance.

https://www.enforcementtracker.com/ETid-1022

I see how what I wrote can be read as stating that an individual can’t be fined.

Please note that that is not what I’ve meant. I’ve updated my comment with a bit more info.