The library hadn’t had any updates in 2 years before this. Clearly it wasn’t maintained. If you’re a user and bothered by this super edge case “vulnerability”, fork it and take on the responsibility yourself.

2FAS is open source and doesn’t have a cloud presence to store data. You can use it to add 2FA to your other services as well.