RELEASING PACKAGES WITH A VALET KEY: NPM, PYPI, AND BEYOND

Summary from the TLDR Dev newsletter

Publishing packages to registries requires access tokens. Whoever has these tokens can publish anything under that organization's name. This can be an issue if those tokens were stolen. One way to secure against this is to create a separate repository dedicated entirely to publishing. This limits write access while still allowing people to contribute.