The author discovered 10,000 malicious GitHub repositories that copy legitimate projects and add links to zip files containing Trojan malware in their README files. These repositories update every few hours by deleting and re-pushing commits, likely to evade detection algorithms. The author created a script to identify these repositories using patterns like frequent updates, copied commits from other repos, and README modifications. GitHub eventually began deleting the identified repositories after the findings were published.