OIDC trusted publishing E404 when publishing scoped packages from changesets/action

Is there an existing issue for this?

• I have searched the existing issues and found similar reports: #8730, #8678

This issue exists in the latest npm version

• I am using the latest npm (upgraded via npm install -g npm@latest in workflow)

Current Behavior

Publishing 12 scoped packages (@sbtools/core, @sbtools/sdk, @sbtools/plugin-*) via npm trusted publishing (OIDC) from GitHub Actions fails with E404 on all packages:

npm error 404 Not Found - PUT https://registry.npmjs.org/@sbtools%2fcore - Not found
npm error 404 '@sbtools/core@0.2.0' is not in this registry.
npm notice Access token expired or revoked. Please try logging in again.

The workflow uses OIDC (no NPM_TOKEN):

No NPM_TOKEN found, but OIDC is available - using npm trusted publishing

Provenance is signed successfully before the PUT fails:

npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log

Expected Behavior

npm publish should succeed using trusted publishing (OIDC) without NPM_TOKEN.

Steps To Reproduce

• Repo: https://github.com/bazokhan/supabase-tools
• Workflow: https://github.com/bazokhan/supabase-tools/blob/main/.github/workflows/release.yml
• Trigger: push to main (when changesets determines packages to publish)

Workflow config:

• Node 22
• npm install -g npm@latest (to satisfy npm 11.5.1+ requirement)
• id-token: write permission
• changesets/action runs npx changeset publish --no-git-tag
• Trusted publishers configured on npm for all 12 packages: repo=bazokhan/supabase-tools, workflow=release.yml

Environment

• npm: latest (via npm install -g npm@latest)
• Node.js: 22.22.0 (GitHub hosted runner)
• OS: Ubuntu (GitHub actions runner)
• Monorepo with 12 packages in packages/*

Verified

• @sbtools npm org exists
• All 12 packages have trusted publisher configured on npmjs.com (repo: bazokhan/supabase-tools, workflow: release.yml)
• Workflow runs directly on push to main (no workflow_call)
• id-token: write is set

Start with the linked .github/workflows/release.yml and reproduce the scoped-package publish through changesets/action using Node 22, npm latest, and id-token: write. Trace the npm trusted-publishing path around the failed PUT to the npm registry, then add regression coverage showing that all scoped packages publish successfully with OIDC and no NPM_TOKEN.