totp on gh doesn't "secure your dependencies" in any meaningful way though. For example npm and rubygems and dockerhub, and pretty much any other library packag

totp on gh doesn't "secure your dependencies" in any meaningful way though. For example npm and rubygems and dockerhub, and pretty much any other library packaging system don't pull code from gh, so the code on gh doesn't need to match the code in the library you are actually installing and running. git secures itself. You can't "sneak" malicious code into a library if you can log into a dev's gh account. All you can do is add commits. It would be an obvious commit and the dev wouldn't push it to their package host.