No, it isn't an extension. It's been in the works for a while. PyPI started supporting 2FA 4 years ago (HN at https://news.ycombinator.com/item?id=20055340 http

No, it isn't an extension. It's been in the works for a while. PyPI started supporting 2FA 4 years ago (HN at https://news.ycombinator.com/item?id=20055340 https://news.ycombinator.com/item?id=20055340 ) and last year required 2FA for the most widely used accounts (HN at https://news.ycombinator.com/item?id=32058053 https://news.ycombinator.com/item?id=32058053 ). One of the objections about it at the time was on HN at https://news.ycombinator.com/item?id=32037562 https://news.ycombinator.com/item?id=32037562 . I think another Python dev didn't want to deal with 2FA and stopped the project, but I can't find that link. In any case, this multi-year phase-in is the sort of ratcheting steps you do when you want to make a change, and it's a big change, and you don't want a flag-day migration. Or, if you don't like it, you use the boiling frog apologue - https://en.wikipedia.org/wiki/Boiling_frog https://en.wikipedia.org/wiki/Boiling_frog .