Staged publishing and new install-time controls for NPM