title: Prevent `npm publish` when ran directly
body: <p>I am not sure weather it is possible or not.</p>
  
  <p>Is it possible to prevent publish when <code>npm publish</code> ran directly and make it accessible only via scripts.</p>
  
  <p>User must be denied when <code>npm publish</code> is executed directly. i.e. User mush be able to publish via any scripts or <code>npm run &lt;script&gt;</code></p>
  
  <h1>or</h1>
  
  <p>is there a way to tell npm only to publish <code>&lt;folder&gt;/</code> or to look for a tarball when published.</p>