I had a problem where the action would fail with 403 when trying to push to a custom registry. I noticed that in the .npmrc the registry URL was truncated (so instead of //some.domain/a/path/:_authToken=${INPUT_TOKEN} there was //some.domain/:_authToken=${INPUT_TOKEN}).
With a small change in npm-config.ts to use the full URL the action succeeded without any further problems:
let authDomain = registry.href.slice(registry.protocol.length);
if (!authDomain.endsWith("/"))
authDomain += "/";