People should really stop keeping credentials that allow publishing to be stored unencrypted on their dev machines. SSH keys should be encrypted with a strong password, and use read-only tokens, if needed at all, for npm. Publishing to npm should be handled via CI builds, not local dev machines.