This was well written. NPM is basically run like Github. I had always thought it was some non-profit org, but that's not the case.

It is possible NPM could take the Github route with ssh tokens and only limit NPM publishes to certain authorized computers; a minor step, but you'd have to compromise the computer as well. That could probably be an option in the NPM settings as an extra step.