I understand your concerns, but if someone has access to your machine your Github password is the least of your worries.
You can just request a token[1] using the GitHub API on first load and then use that. I implemented that recently in Pulley[2], which is a GitHub Pull Request Lander.
[1]: http://developer.github.com/v3/oauth/#create-a-new-authoriza...
[2]: https://github.com/jeresig/pulley
I understand your concerns, but if someone has access to your machine your Github password is the least of your worries.