With NPM now supporting OIDC, you can just turn this off now https://docs.npmjs.com/trusted-publishers