I've contributed multiple issues and PRs which have been completely ignored. It seems from the outside that their focus on monetizing causes their API to be purposefully opaque and subject to change. It's been disappointing and certainly turns me off from ever purchasing private repo hosting from npm itself.
For reference:
https://github.com/npm/npm/issues/12085
https://github.com/npm/npm/issues/8319
https://github.com/npm/couch-login/pull/13
I have a deep understanding of how it works now, and therefore more to contribute, but what's the point? I just keep running my own npm(s) instead and contribute to packages that appreciate it.