If GitHub always uses the same number(s) for 2fa and there are outgoing texts to your number then the connection is obvious. I’ve read that sim jacking is somewhat common and this would be a good data point.
You would effectively be able to cross reference this meta data with 2 factor authentication services. It’s probably time to start removing this option entirely.
This is the way. I moved everyone I work with at over to the pyenv, virtualenv, poetry stack. Once you get set up it’s pretty smooth sailing. It is a shame that so many tools are needed to work with python, but I was happy to finally find something that works.