Thanks for the reply, this is exactly what I was looking for! I guess the piece I was missing was that there were additional permission options that aren't exposed by default, but that I could bring in by adding a new task. The links you provided helped me fill in those gaps, so thanks again for that!

Tried reading the documentation and searching the forum and unfortunately couldn't seem to find an answer to this: Is there a setting anywhere so that I can block the publishing of a package to an npm registry if there is already an existing package with the same version number in the registry? Occasionally developers will bump up the version number in the package.json at the root folder rather than the one in the lib folder and will end up publishing over top of an existing package before realizing the mistake. I'd like to make it so that's not physically possible.