LOL, seriously? There are ~1 mln people living in Irkutsk, Bratsk and Angarsk (all UTC+8). And there are much bigger cities in UTC+7 like Novosibirsk and Krasnoyarsk. Of course there are much fewer people than in China but that’s not “almost no one”.
However I agree that the malicious actor is likely from Europe or Middle East. I also investigated their activitity time but instead of commit timestamps that are easy to fabricate I looked at their GitHub activity time. Unfortunately, the GitHub API only allows to get events for the latest 90 days, but that is enough make some guesses (but not to say if they live in a country with the daylight savings time switchover).
Below are extracted timestamps for those who want to examine them.
If we assume that GitHub activity occurred during working hours 9:00 – 18:00, then the timezone is UTC+0, not UTC+2. There are only 6 events outside that interval, 5 of which occurred between 18:00 and 19:00 UTC.