GitHub vulnerability reports are also notified on my abandoned repos

I don't have time or drive to correct all of my old repos. What should I do with it?

Just accept suggested PR's? What about the possibilities of breaking what is already working?

If it is a relative popular repo, maybe I would try to correct it. But if no one else use it, and even I am not currently using it? Not all GitHub repos are published in NPM.

Also, is it just me, or NPM packages usually have more vulnerabilities than perhaps, Python's PyPI?