npm Trusted Publishing Skill Critical Requirement npm CLI 11.5.1+ is mandatory for trusted publishing. with Node 22 still bundles npm 10.x, which CANNOT complete the OIDC token exchange for the actual registry publish. The error is a misleading on — after provenance successfully signs. This wastes hours if you don't know the root cause. The Misleading Error When using npm 10.x with trusted publishing configured correctly, you see: This is NOT a missing package or auth config problem. It is npm 10.x being unable to exchange the OIDC token for a publish token. The Fix: Use npm 11 for Publish On…