After SlugFest, check each package's Trusted Publisher binding with npm trust list and confirm the slug still resolves to a repo you control. If you renamed, transferred or deleted the bound repo (or renamed the org), delete the binding and recreate it, then publish from it right away: GitHub now expires unvalidated configs after 48 hours and binds a config to the repository on its first successful publish. Move publishing off issue_comment and pull_request_target triggers, and alert on any publish that doesn't come from your expected repo and workflow.