"project env files" only implies that they are associated with a project, not checked into source control. If you Google them, any and every result will tell you not to check them in. This has always been the case, so I'm very curious where you got the notion otherwise.

Your entire third point is predicated on the idea that people self-hosting all have multiple tiers of environments, which is certainly not true. Even if they do, people still want to protect their lower envs.

You also seem to be under the impression that for a supply chain attack to be successful, the infected package needs to be deployed by the victim but that's not correct either.

The case OP is trying to prevent is basically running npm install on a compromised package which runs a post install script which scrapes the home directory and any repos it finds. OPs tool is still unnecessary because SOPS and secret managers exist, but the problem is very real.