Anyone maintaining a library with a large audience of consumers should be mandated to use 2FA/MFA, I can only assume from the information here that they only had a set of credentials for authing :-(