Removing the GitHub repo does not end exposure here. Go builds can still resolve the poisoned v1.3.3 artifact from proxy.golang.org, so a deleted upstream account does not remove the malicious package from the build path.
Socket says github.com/shopsprint/decimal has impersonated shopspring/decimal since 2017 and was weaponized on 2023-08-19 in v1.3.3 with a malicious init() and DNS TXT command-and-control. The GitHub repository and owner account are gone, but the release is still listed on pkg.go.dev and still served by the Go module proxy.
That extends the blast radius to any project that pulled the typosquat at build time, including indirect dependencies and mirrored caches. Standard dependency review that only checks the live repo can miss an artifact that remains available through the ecosystem’s distribution layer.