NPM token will have a limited lifetime.

[ringods]

Github announced forthcoming changes in increasing the security around NPM authentication tokens:

https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/

In short: you will have to refresh the org level NPM_TOKEN secret for Github Actions workflows every so often. Please make sure the board has a process around this or package publishing to npmjs.org will fail frequently.