More to the point, if a package maintainer turns malicious, as it appears was the case here, none of the changes this article is suggesting will help at all. 2

More to the point, if a package maintainer turns malicious, as it appears was the case here, none of the changes this article is suggesting will help at all. 2FA means nothing if you can't trust the person publishing the package.