Funny thing is… the nature of git repos is when you work on the code base the first step is cloning it. The more contributors you have the more clones. The process naturally propagates distributed backups, albeit some being liable to be more out of date than others. I’d be interested in learning how successful this actually is for the attackers over time. I expect most maintainers will simply take the lesson learned, update their repo’s security and access controls, and restore the code base from the most recent local clone.