With node_modules cached, npm install sees the scratch-* dependencies satisfied (since if any version 0.1.0-prepublish.x satisfies ^0.1.0-prepublish). So remove these before the install step to ensure the latest version is installed.
Authenticate with NPM via .npmrc and publish the package version + "-[git sha]".
Remove vm and vm.min.js, they'll be built before the package is published to NPM and available on installation. When installing from git, the build step will run on npm install.