While the official packages were not compromised, the malware-injected clones were discovered via a google search for the original repository, meaning that users may have inadvertently installed the malware on their system. Companies should include the downloading and updating of GitHub repositories as part of their Change Control Plan, verifying that the code being pulled is from the original author and signed with their GPG keys.

Companies may also find value in including Dev environments as part of their SIEM. There is extra overhead to managing alerting for a Dev environment, since development activities frequently trigger false positives, but with some tuning out of normal behavior, malicious code mistakenly downloaded and integrated can be detected this way.

https://www.bleepingcomputer.com/news/security/35-000-code-repos-not-hacked-but-clones-flood-github-to-serve-malware/