It would be nice to be able to enable "Trusted Publisher" and be able to use an alternative npm publishing workflow that handles doing trusted publishing to avoid needing to keep a NPM_TOKEN in the repository

Theres examples of how to implement trusted publishers here:
https://docs.npmjs.com/trusted-publishers

Enabling trusted publishers does require that the package exists first so it would likely need to exist alongside the existing npm publishing workflow as a option that can be turned on to switch between the versions.

Thanks for your consideration