Is there any way to prevent publishing public packages under an npm org?
It seems like this would be a relatively common use-case (making sure noone in an org can unintentionally publish a package that's supposed to be private because they run publish --access public). But I can't find a way to enforce that.
That capability appears to only be available in npm Enterprise.
As described here:
Note: The unscoped namespace on npm Enterprise is reserved for unscoped packages in the public npm registry. To prevent npm Enterprise users from accidentally publishing proprietary code to the public npm registry, where it would be visible to anyone on the internet, we do not allow publishing unscoped packages to npm Enterprise.
There is a way actually with https://www.npmjs.com/package/secure-publish
$ npm add -D secure-publish
Then you should add prepublishOnly script to your package.json:
...
"scripts" : {
"prepublishOnly": "secure-publish"
}