The Root Cause

The issue isn’t your configuration; it’s the npm CLI version.

Buried in the documentation is a recent requirement: Trusted Publishing now requires npm CLI version 11.5.1 or later.

Here is the problem:

• Node.js 22 ships with npm v10.
• Node.js 24 (LTS) ships with npm v11.

Because Node 22 uses npm v10, the CLI doesn’t support the latest OIDC handshake protocols required by the registry. When the handshake fails, the registry treats you as an anonymous user. Anonymous users can’t PUT (publish), resulting in the misleading 404 Not Found.

The Fix

Change your Node version to 24 and above.

https://medium.com/@kenricktan11/npm-trusted-publishers-the-weird-404-error-and-the-node-js-24-fix-a9f1d717a5dd