Thousands of commits hit public GitHub repositories every minute, and a meaningful slice of them are hostile: credential stealers, reverse shells, crypto drainers, and nation-state lures wearing the costume of a coding challenge. The same things that make GitHub great for developers (openness, trust, free hosting, a domain nobody blocks) make it excellent disposable infrastructure for attackers. This talk is about what happens when you try to watch all of it. I'll walk through a pipeline that scans the public event stream in near real time, the deobfuscation engine that turns walls of XOR'd, packed, and base64'd gibberish back into something a detection rule can match, and the messy reality of keeping false positives low enough that a human analyst still trusts the queue. Then the fun part: who's actually out there, including DPRK-aligned crews running fake job interviews to backdoor developers at crypto firms. Much of the data is first triaged by an autonomous AI analyst turned loose on live adversary infrastructure from a throwaway VM. You'll leave knowing how to build this visibility yourself, and why GitHub belongs in your threat model next to email and the browser.