The package owner registers a trusted publisher on the registry (for example repository org/name, workflow release.yml, optional environment); at publish time the CI job presents its OIDC token, the registry checks the claims and returns a credential valid for minutes. Nothing long-lived exists to leak from CI logs or a developer laptop, which addresses the most common route of package hijacking.
Registries combine it with provenance: npm publishes provenance automatically under trusted publishing (npm CLI 11.5.1 or later), and PyPI's official GitHub action produces PEP 740 attestations by default. Protect the workflow itself: required reviewers on the release environment, pinned actions and branch protection, since whoever controls the workflow can publish.