[BUG] OIDC failures aren't logged by default #9923

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

If there's a problem exchanging an OIDC token during trusted publishing, it doesn't get logged by default, I just get:

npm error code ENEEDAUTH
npm error need auth This command requires you to be logged in to https://registry.npmjs.org/
npm error need auth You need to authorize this machine using `npm login`

I can't tell from this if it even picked up my NPM_ID_TOKEN.

Only after I used --loglevel=silly did I see:

npm http fetch POST 404 https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/@jcoreio%2ftoolchain 845ms
npm verbose oidc Failed token exchange request with body message: OIDC token exchange error - package not found

Expected Behavior

All OIDC failure messages in https://github.com/npm/cli/blob/latest/lib/utils/oidc.js are logged at error or warn level
(I'll be happy to make a PR if you agree)

Steps To Reproduce

1. Set NPM_ID_TOKEN to an OIDC token that will error out for some reason (in my case, it had the CircleCI SSH rerun claim)
2. Run npm publish (with default log level)

Environment

• npm: 12.0.2
• Node.js: 24.20.0
• OS Name: any
• System Model Name: any
• npm config: default