npm Trusted Publishing fails with a 404, and the 404 is lying to you

npm is winding down 2FA-bypass granular access tokens. Since 31 July 2026 they can no longer perform account, organisation, or package management operations, which includes editing trusted publishing configuration. In January 2027 they lose direct publish as well, leaving them able to read private packages and stage a publish that a maintainer then approves with 2FA.

The replacement is OIDC Trusted Publishing, where you register a GitHub repo and workflow on npmjs.com and the workflow authenticates with a short-lived token instead of a stored secret.

I migrated. The release workflow then failed four times in a row, and the error message pointed nowhere near the actual problem.

This is the writeup I wanted to find while debugging it.

The symptom