The payload was a Cobalt Strike beacon. Approximately 8,000 users were compromised before GitHub DMCA removal.
For the average user, the safest path is to either run Windows unactivated (accepting the cosmetic limitations) or purchase a genuine license. Your data security and system stability are worth far more than the price of a license key. github windows activation
You do not strictly need a license key to use Windows 10 or 11. Microsoft allows you to install and run Windows without activation indefinitely. The payload was a Cobalt Strike beacon