“A third-party can’t reasonably register 15,000 GitHub accounts.”
VulnCheck counts more than 9,000 Go module repos exposed by GitHub username changes and more than 6,000 by deleted accounts. An attacker registers the abandoned name, copies the repo and publishes a new module to the Go proxy. GitHub’s namespace retirement only kicks in after 100 clones, and Go modules come from the mirror cache without clones. Go and GitHub each built half the hole, and each can point at the other.