Isn't the point of the report more that npm publish will work using save credentials rather then that arbitrary scripts can be run?