Good step considering the elevated rate of supply chain attacks. This will make such attacks harder, won’t completely eliminate the threat unless devs have a completely separate 2FA device and don’t store it on same device they publish from. Having said that, there’s still a possibility of compromise if the malware silently adds code which escapes code review.(Nischal Shetty)