> why would you need to download a fresh copy of a dependency that almost never gets updated

The nature of this attack is that 700 forks with each their isolated CI containers is downloading the file oblivious to all the other downloads. If GitHub were to cache this download, they'd have to man-in-the-middle, but people are using curl/wget and not a package manager with caching mirrors.

I'm not even sure cleaning up these 700 DDoS'y forks is that easy.