Quoting: "I'd rather just write code for fun and only worry about supply chain security when I'm actually paid to do so"
A Python package in use enough to be flagged 'critical' could be earning a few hundred US dollars per month through Tidelift if the maintainers sign up. Which should more than compensate the 2FA overheads.
