The user found 10,000 GitHub repositories distributing Trojan malware by analyzing commit patterns and using a script to filter repositories. The script found 10,000 repositories that matched the pattern of being updated every few hours with a link to a zip archive in the readme file, but the user believes there should be many more due to GitHub's large repository count.