new credentials handling for npm