[thephyber]

The ghost repo trick sounds similar to a subdomain takeover. I can foresee this being a vector for publishing malicious code.