We'd like to be able to label / prevent auto-merge on PRs where the release was published to NPM by a new maintainer. This would allow us to do a manual security review and probably wait a bit to ensure permissions to publish wasn't granted to a bad actor.