What worries me is that this is possible at all. npm stores npmjs.org credentials in a repository-local dotfile, and this is how packages are submitted?!<p>PHP&#x27;s package repository, Packagist, doesn&#x27;t have this problem because it&#x27;s in the browser. You never enter or store any credentials on the command-line, you click a button on the Packagist site and it tracks your already-published GitHub repository.