But it still doesn't stop infected developer machines to silently update code and wait for the next release patiently.
It would require the diligence of those developers to check every line of code that goes out with a release... which is a lot to ask for someone who fell for a fishing email.
Or wonder if GitHub is enforcing 2fa soon because of the NPM CVEs potential to harvest GitHub creds?