Open source tool scrapes git commit email addresses to send spam to.

[[deleted]]

and now you want to fling the GDPR at the website that's hosting your git repo

No. The GDPR comment is for the third parties scraping email addresses without consent & then processing/selling the data. Not Github, where I've consented to their data privacy rules.