why does github have zero malware scans?

It does have malware scans, though you might not have seen them as they're only shown to repository owners (and other appropriately authorised persons with Github Pro or Enterprise). That doesn't help if the owner is malicious or absent; I really don't know which applies to your case.

But... nothing should be taken down just on the say-so of some random person, otherwise that provides a different avenue for vandalism. Even doing so automatically based on some tool would be dangerous, as such tools are known to usually have non-zero false positive rates. About the best you can hope for is prodding someone to take a look... though everyone in Github seem to be busy with many other things too.

Contact support with your specifics. You've clearly got a case that nobody other than them can help with. A general complaint won't change anything, and that's unlikely to ever change for good reason, but specific cases can be handled.

I did contact them and nothing happened. its media downloader. full of trojans. somehow malwarebytes can catch it but github cannot