All steem-js tests use a key that is valid on the MainNet. This means that all transactions used for testing are actually valid transactions. Thankfully, these are only transactions that require a posting auth.
These tests should be changed to use an authority not on the MainNet (blocked by steemit/steem#3546)
Furthermore, there are some tests that require active auths that do not work. These can be updated and pass safely without providing active keys in the repo.