I do not envy the position the npm team are in. They removed the ability to unpublish packages as a response to the left-pad incident[1] because it wasn't desirable for individual developers to break downstream dependencies by pulling their package maliciously.
Of course the side effect is that now it's much harder to pull packages for legitimate reasons :/
Of course the side effect is that now it's much harder to pull packages for legitimate reasons :/
[1] https://en.wikipedia.org/wiki/Npm_left-pad_incident