Either way he'd be pulling from Github.com at some point, whether in the build environment or production. He won't ever know that the repository was compromised

Either way he'd be pulling from Github.com at some point, whether in the build environment or production. He won't ever know that the repository was compromised. Besides, some people use Heroku simply to deploy their rails or node apps, and they don't have an artefacts server.