[mirashii]

If 2fa is enforced, having your password doesn't get you anything. Publishing an npm package isn't having a Twitter account, it's one of those things where enforcing 2fa shouldn't even be a usability question.

[Already__Taken]

how does 2fa work with auto publishing CI pipelines?