3 ms·

Wow, this is an amazing outcome here. Why is "unpublishing" something that can happen in npm? What's the point? I can see the downside, what's the upside?

• Klathmon 11y ago
  A few reasons off the top of my head: * People sometimes accidentally publish bad info. Passwords, private keys, personal information, etc... being able to remove that is a big plus * if a critical security issue were found in a package, removing that version and adding a new one will practically "force" updates to happen.
  • taumeson 11y ago
    that first bullet point really makes sense to me - feels like there's "no right answer" for that one. i wonder if some kind of time frame would help - one has 72 hours to unpublish, etc. thanks for answering!
    • d0m 11y ago
      Maybe one possible way to fix this problem is to let you unpublish it as long as no one else downloaded it. I.e. once I've got your security, then you're already compromised and you need to change it.