npm trusted publishing is a release method that lets a CI workflow publish packages with short-lived, workflow-bound identity instead of a long-lived registry token. The workflow proves who it is at publish time, often through federated identity such as OIDC, and npm accepts that proof only for the authorized repository and job.
This matters because registry tokens are high-value secrets: if stolen, they can be reused to publish malicious code from anywhere. Trusted publishing reduces that risk by removing durable credentials, but it does not remove trust from the system. Attackers who compromise a maintainer account, a GitHub workflow, or repository settings can still abuse the publish path and make a release look legitimate. Defenders should limit which repos can publish, review workflow changes carefully, and verify that new package versions align with expected build activity.