If you don't want all users of the repository to see the plaintext token, you can encrypt it with Renovate's public key instead, so that only Renovate can decrypt it. Go to https://app.renovatebot.com/encrypt, paste in your npm token, select "Encrypt", then copy the encrypted result.