I checked the library and it seems to be using v2 of the Reporting API in Google Analytics. There's a new v3 version of that API.
And for authorization it's using ClientLogin. From the ClientLogin docs:
Important: ClientLogin has been officially deprecated as of April 20, 2012. It will continue to work as per our deprecation
policy, but we encourage you to migrate to OAuth 2.0 as soon
as possible.
.
Important: If any of your customers are having trouble with ClientLogin, their account may not be compatible with it for a variety
of possible reasons. For example, accounts that use 2-step
verification, SAML, or Open ID are not compatible with ClientLogin.
One workaround is to tell users to generate a single-use password,
provided by access codes, which allows them to log in to their
account in a web browser and generate a long password that they can
type into the password field of any application using ClientLogin. A
better solution is to convert your app to use OAuth 2.0, which is
compatible with all existing Google accounts.
If you have 2-step verification enabled in your account you should try the access codes workaround, otherwise you should contact library developers and propose that they move away from the deprecated authorization method.