"If the user had enrolled a Security Device for PyPI second factor authentication, the attacker would not have been able to use the second factor, as the WebAuthn protocol requires the user to physically interact with a hardware security key, or use a browser-based implementation, which would not be possible if the user was not on the legitimate PyPI.org website (Relying Party Identifier)."

https://blog.pypi.org/posts/2025-07-31-incident-report-phish...

Don't use TOTPs if you have an option to use Passkeys/WebAuthN

Short video example: https://taptrap.click/