> I maintained a very popular NPM package with 43+M weekly downloads
makes sense why they targetted you, good that you have 2FA enabled.