If you've identified GitHub repositories hosting malware, you can report them directly to GitHub via their Abuse Report page, providing links and any relevant details. GitHub typically removes repositories that violate their Acceptable Use Policy, but response times may vary. If the malware is actively being used for harm, you may also consider reporting it to security organizations or CERT teams.
One thing I appreciate about Github is that every time I've reported something, I've felt like an actual human went through my report and actually read the things I wrote. Perhaps it's a bit silly to appreciate basic human interaction, but for so many online environments the only interaction you'll ever see is done through chatbots and automated work flows.