Maybe. I'll note that we do npm install in a separate gitlab-ci step as other steps that are running the code (we then share the modules via artifacts). Actuall

Maybe. I'll note that we do npm install in a separate gitlab-ci step as other steps that are running the code (we then share the modules via artifacts). Actually the publishing / deployment are also done in separate steps, so we could make sure that only the deployment step have the credentials (though I'm not sure it's possible with gitlab-ci atm) which would be a much better improvement than preventing npm scripts (which I'm still not convinced do bring more security without further improvements)