Also, not all attackers who have control of a github account or the artifacts published on it are the original author of the software. If the threat actor is hoping to hide their own identity, that may limit their willingness to do things that produce audit logs...