Vulnerability #319816 – npm responds

Isn't the point of the report more that npm publish will work using save credentials rather then that arbitrary scripts can be run?