publish-npm-package

The content provides legitimate npm trusted-publishing workflow templates and contains no clear malicious behavior or embedded malware. Security risk is moderate because release jobs execute repository-controlled code with publishing and, in some cases, broad GitHub write permissions; actions are not pinned to immutable SHAs; and the prerelease shell example may permit tag-derived shell injection. Pin actions, constrain permissions, validate release tags, and review dependency lifecycle scripts before production use.