That's usually what those security companies do, they monitor all those repositories and look for patterns, then investigate anything suspicious.