[BUG] OIDC trusted publishing fails with "package not found" for GitHub repos that use immutable OIDC subject claims

Is there an existing issue for this?

• I have searched the existing issues (closest: #8678, #8730, #8976 — none mention immutable subject claims)

This issue exists in the latest npm version

• I am using the latest npm — reproduced with npm 11.19.0 (the version on GitHub-hosted runners with Node 24.20.0). The failure is the registry's response to the token exchange request, so it does not look CLI-version specific; happy to retest on 12.x if needed.

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

Trusted publishing from GitHub Actions fails for design-system-axi (unscoped, public, already published as 0.1.0). The OIDC token exchange is rejected with package not found, npm then falls back to the placeholder token written by actions/setup-node, and the publish fails with E404:

npm http fetch GET https://run-actions-2-azure-eastus.actions.githubusercontent.com/155//idtoken/***/***?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 218ms
npm http fetch POST 404 https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/design-system-axi 899ms
npm verbose oidc Failed token exchange request with body message: OIDC token exchange error - package not found
npm http fetch GET 200 https://registry.npmjs.org/design-system-axi 158ms (cache miss)
npm http fetch PUT 404 https://registry.npmjs.org/design-system-axi 129ms
npm error code E404

The trusted publisher configuration on npmjs.com matches the workflow exactly:

• Provider: GitHub Actions
• Repository: isamrish/design-system-axi (public)
• Workflow filename: release-please.yml
• Environment: none
• Permissions: npm publish, npm stage publish

The repository was created on 2026-09-14. Per GitHub's changelog (https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens/), repositories created after 2026-07-15 use the immutable subject format, and it cannot be switched off for this repository (PUT /repos/{owner}/{repo}/actions/oidc/customization/sub with use_immutable_subject: false returns 201 but the setting stays true).

Decoded (non-secret) claims of the token npm requested (aud: npm:registry.npmjs.org):

iss: https://token.actions.githubusercontent.com
sub: repo:isamrish@6524419/design-system-axi@1369171675:ref:refs/heads/<branch>
repository: isamrish/design-system-axi
repository_owner: isamrish
repository_id: 1369171675
repository_owner_id: 6524419
repository_visibility: public
workflow_ref: isamrish/design-system-axi/.github/workflows/release-please.yml@refs/heads/<branch>
job_workflow_ref: isamrish/design-system-axi/.github/workflows/release-please.yml@refs/heads/<branch>
event_name: workflow_dispatch (also fails on push)
environment: (none)
runner_environment: github-hosted

All claims match the trusted publisher configuration except the sub format, which differs from the legacy repo:<owner>/<repo>:ref:... format used by repositories where trusted publishing works for us.

Ruled out:

• npm CLI version (11.19.0 ≥ 11.5.1), Node 24.20.0
• permissions: id-token: write present (the provenance statement is signed and logged to Rekor in the same step)
• contents: write in addition to id-token: write (same result)
• package.json repository.url = git+https://github.com/isamrish/design-system-axi.git
• owner/repo capitalization, no environment configured, public repository

Expected Behavior

The token exchange should succeed for GitHub Actions OIDC tokens that use the immutable subject format, as it does for the legacy format.

Steps To Reproduce

1. Create a GitHub repository after 2026-07-15 (so use_immutable_subject is true).
2. Publish an npm package from it once manually, then configure a GitHub Actions trusted publisher for the repository and workflow file.
3. In that workflow, with permissions: id-token: write, run npm publish --access public --provenance on a GitHub-hosted runner (Node 24, npm 11.19.0).
4. Observe OIDC token exchange error - package not found in verbose logs and E404 on PUT.

Environment

• npm: 11.19.0
• Node.js: 24.20.0
• OS: ubuntu-latest GitHub-hosted runner (ubuntu 24.04)
• registry: https://registry.npmjs.org/
• Workflow: https://github.com/isamrish/design-system-axi/blob/main/.github/workflows/release-please.yml

Start by reproducing the exchange from .github/workflows/release-please.yml with npm 11.19.0, using the documented immutable-subject claims and the verbose token-exchange logs. Trace how npm handles the registry's OIDC response and fallback token; done means trusted publishing succeeds for the immutable subject format without E404.