We are looking to implement a process in our open source project where all Pull Requests will be published to npm using CI/CD. To reduce the potential for supply chain attacks, we aim to deploy to a separate organization. Can this be achieved without making changes to 'package.json'?
Additional information: Modifying package.json
is not a simple task in our scenario due to multiple interdependent packages within the same repository, which are managed with lerma.