Basically because it's all just github, the package author and publisher are intrinsically linked because the package repo is directly associated with the code

Basically because it's all just github, the package author and publisher are intrinsically linked because the package repo is directly associated with the code repo. In NPM, there is not any way to directly ensure the publisher and package author are the same because they're different systems.