Publishing could require clicking an email confirmation link, sent by npm.

It's all pointless theater because people want less friction to do what they want, not more. They'll just automate away the friction points like clicking an email confirmation link.

	▲	jeswin 5 days ago \| parent [-]
		If you're the author of ducklib, and you get an email asking "Did you just publish ducklib 2.4.1?" with a fair number of warnings in the mail text, will you click on the publish link? I certainly wouldn't. And I don't see it as pointless theater. It requires deliberate action, and that's what's missing here.