npm Adopts OIDC for Trusted Publishing in CI/CD Workflows

npm has launched Trusted Publishing with OpenID Connect (OIDC) authentication, allowing secure package publishing from CI/CD workflows without long-lived tokens. This feature uses ephemeral credentials, provides automatic provenance attestations, and eliminates secrets management overhead. Currently supporting GitHub Actions and GitLab CI/CD, it addresses recent supply chain attacks by replacing vulnerable persistent tokens with short-lived, cryptographically-secured credentials that significantly reduce attack surfaces.