I thought npm started requiring hardware keys for publish, or may have been new accounts only