I had enabled 2FA for GitHub using a mobile number. Today when I tried to log in from a different device, during the 2FA verification time, I received the code from a consumer phone number [ +91 7906173### ], stating the TOTP as "Github authentication SDT".
Being sceptical, I had opted to resend the OTP and then received a different OTP as "Github authentication code"
I rechecked the number with truecaller:
As an SOP, I have changed my password and 2FA verification method.
Can anyone help me to understand what is going on? What is "GitHub authentication SDT" and why I have received my 2FA OTP from a consumer mobile number? Are my account and the old password secured?
P.S: I have not found and suspicious SAML log-in session.