> This means that simply by opening a pull request into the right repo, you can gain authorization to publish packages.

But that is not all what happened here... Or am I reading this wrong?