i turned on 2fa for my npm account, and my published libraries aren't even at 1K downloads _total_ yet.

these guys with libraries that have a massive user base really have no excuse besides laziness for not having 2fa on their account.