I received this email and did not appreciate it too much also. It is like: "Congratulations, you are designated as critical, as one of the top downloaded packa

I received this email and did not appreciate it too much also. It is like: "Congratulations, you are designated as critical, as one of the top downloaded package" So you think, awesome, what is my prize? "You won the right to have more restrictions on your account" I think that it would be ok for the index to show which package are 'safer' but indeed not do it like that. In the best world, I would imagine something like that: Your package is tagged as not 2fa safe. Users can pledge a donation to the maintainer to motivate him to use or keep using 2fa. That he can't get without using 2fa. Something like that so the maintainer does not have all the burden that only benefit to 'free' users.