VulnCheck researchers that while they aren't sure if the unknown actors have succeeded in infecting devices, but they have been persistent even when their repositories are reported and taken down.
Article Link: Someone is posing as a fake security company to create malicious GitHub repositories | SC Media