Martin from GitHub here - the offending repos have been taken down, but the article from Roman is still very much worth reading to understand the attack vector attempted.