only allow admin to publish packages
update README.MD