As an aside, it would be neat if publishing services like this had a sort of 2FA, eg the package manager had a hook endpoint where it sent the details of the next requested published version. Allowing the owners to validate.

Kinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.