One more attempt :-(

concourse/tasks/npm-publish.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 set -e
+set -x
 workdir=`pwd`
 sources=$workdir/sources_repo/${sources_dir}
 cd $sources
@@ -9,5 +10,5 @@ unsafe-perm=true
 //registry.npmjs.org/:_authToken=${npm_token}
 XXXXXX
 
-npm install
-npm publish
+npm install --unsafe-perm
+npm publish --unsafe-perm