> I reported the repo to GitHub and the recruiter to LinkedIn. So far nothing has changed and the code is still up.

Github is really slow when it comes to malicious repos. You'll probably get an email randomly six months from now when they finally see it.