Even that might not work if he has two versions with the same hash and sends github a forced update with push -f. though that's still a much more difficult proposition than just updating the master branch.
If he can generate two files with the same hash he can do much more interesting things than write a sketchy python script that a few people might run without reading.
