I think that should be enough. Maybe try two vCPUs if you wanna host other stuff too. But for just some mirrors/aggregators, one vCPU is probably enough. I don't think you really need to worry about RAM or storage either.

Computers are plenty fast these days. I think you'll only start to see actual performance issues when handling hundreds of simultaneous users.

In any case, you shouldn't be spending over $10/month. You can get much lower. Take a look at this. I don't know how reliable or secure they are, but they're very cheap. I've used their VPS in the past, and it seemed pretty okay.

Edit: You can also do what I do for heavier stuff like Jellyfin or Immich, and simply use the VPS as a relay. The actual stuff runs on my home server, connects to the VPS via Wireguard, which then masks its IP.

An advantage of github is that its social network type features give you ways to make more educated guesses about whether a project is legitimate vs a malware trap. It's great that it is not difficult to find alternative hosting for git repos to evade Microsoft's censorship, but I don't think there exists an ideal alternative solution for trust infrastructure, which is extra important for anything piracy related.