"Seems a bit janky to only require 2FA from “critical projects” and not all projects. Why cut corners?" Agreed. I don't know if these projects need 2FA "prote

"Seems a bit janky to only require 2FA from “critical projects” and not all projects. Why cut corners?" Agreed. I don't know if these projects need 2FA "protection" or not - but I'm quite certain that the risk to any particular user is identical whether they are downloading a popular vs. unpopular package. Total, global risk is, of course, higher for popular packages, but any individual user does not care if their intrusion vector was a popular vs. unpopular package ...