Not much. In my experience, they will only take action if it’s obvious. I’ve reported a project three times that is serving malware, but they won’t take it down because it’s using a custom .npmrc and the deps hosted there have the malware. It’s easy to see after npm installing, but they don’t seem to want to do that much investigating.

I imagine it's because the GH Security team are responsible for the security of GH itself, not the million crappy repositories hosted there.

Rather, they ensure that the repos that are malware can't compromise GH's infrastructure and other repositories.

Provide backdoors for the US government