What if it's leveraging a zero day in your zip or https library?

That would be super interesting to have such a large repo when zipped by GitHub then turn into a malicious file. It would be its own front page story.