automate-npm-release

No direct malicious behavior is evident in this workflow. It implements a conventional npm release pipeline, but it has meaningful supply-chain exposure: mutable GitHub Action tags, unpinned npx execution with a repository token, and elevated write and OIDC permissions. Pin actions and changelogithub to trusted immutable versions, minimize permissions, and protect release tags before using this workflow.