Yeah, you have to set provenance flag to true.

  - uses: JS-DevTools/npm-publish@v2
  with:
      token: ${{ secrets.NPM_TOKEN }}
      access: public
      provenance: true

For example