[noomorph]

After npm publish, npm runs an automated malware scan and the version stays unavailable (registry returns 404) until it finishes. Usually ~5 min, can be 15+, no documented upper bound. The release scripts checked the registry once, right after publish, so the publish job failed even though the package was published (run 39783204995) and needed a manual resume.

• poll the registry after publish until the version matches the artifact (every 30s, up to 30 min)
• same wait in finalize
• publish and finalize job timeout 10 -> 40 min
• if the limit is hit, fail with the existing "resume the same release" message (resume is still safe)
• tests: 404 then visible, and the attempts limit

Limit and interval are my choice; npm gives no guarantee.
Source: https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/