👋 I opened #514 to clear up the confusion here - this repository is not malware nor does it contain any malware dependencies. The NPM package github-script is malware, which is just a package using the same name as this repository.

This should be resolved now -

~/projects/github-script-types
❯ npm i -D @actions/github-script@github:actions/github-script

changed 1 package, and audited 39 packages in 5s

found 0 vulnerabilities

~/projects/github-script-types 6s
❯ npm audit                                                   
found 0 vulnerabilities

If you have any questions or further concerns - please don't hesitate to ask!

This works the same way when you only use the types npm i -D @types/github-script@github:actions/github-script.