[BUG] `publishConfig.tag` Not Respected

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm publish doesn't respect publishConfig.tag in package.json, only the --tag CLI flag is respected.

Relate issue https://github.com/jonchurch/semversyphus/issues/2

Expected Behavior

Respect publishConfig.tag in package.json if the --tag CLI flag is not provided.

Steps To Reproduce

https://stackblitz.com/edit/stackblitz-starters-8defdmxd?file=index.js

• npx -y npm@latest publish --dry-run

npm notice
npm notice package: node-starter@0.0.0
npm notice Tarball Contents
npm notice 97B index.js
npm notice 95B package.json
npm notice Tarball Details
npm notice name: node-starter
npm notice version: 0.0.0
npm notice filename: node-starter-0.0.0.tgz
npm notice package size: 269 B
npm notice unpacked size: 192 B
npm notice shasum: b5b93343a4abe41d7ed2ac5ca7e6c7fa6ddc25e0
npm notice integrity: sha512-Ln6+ML5+Jdxav[...]7ZADYLajLINgQ==
npm notice total files: 2
npm notice
npm warn This command requires you to be logged in to https://registry.npmjs.org/ (dry-run)
npm notice Publishing to https://registry.npmjs.org/ with tag latest and default access (dry-run)
+ node-starter@0.0.0

Environment

• npm: 11.6.3
• Node.js: v24.11.1
• OS Name: macOS / Stackblitz
• System Model Name: Macbook Pro / Chrome
• npm config:

; "user" config from /home/.npmrc

global-pnpmfile = "~/.pnpm/.pnpmfile.cjs"
ignore-dep-scripts = true
prefer-symlinked-executables = true
update-notifier = false
verify-store-integrity = false

; node bin location = /usr/local/bin/node
; node version = v20.19.1
; npm local prefix = /home/projects/stackblitz-starters-8defdmxd
; npm version = 10.8.2
; cwd = /home/projects/stackblitz-starters-8defdmxd
; HOME = /home
; Run `npm config ls -l` to show all defaults.

; "publishConfig" from /home/projects/stackblitz-starters-8defdmxd/package.json
; This set of config values will be used at publish-time.

tag = "beta"

Start by reproducing the issue with the linked StackBlitz package.json and index.js using npx -y npm@latest publish --dry-run. Trace how npm publish reads the package's publishConfig.tag and compare it with the --tag path. Done means the dry-run reports beta when no CLI tag is supplied, while an explicit --tag still takes precedence.