The ability to "unpublish" a package is fundamentally strange, because it enables situations like this. It's also strange that people put so much trust and fai

The ability to "unpublish" a package is fundamentally strange, because it enables situations like this. It's also strange that people put so much trust and faith into a private company to host and distribute packages – largely for free – and then rile against them when they do stuff like this with infrastructure they own. NPM is not some free and open space, it's a private company with private interests. You should expect them to do whatever they need to protect those interests – which may or may not coincide with public interest. I hope this resolves in more people getting involved with projects like IPFS and Nix, that may ultimately provide some recourse to the issues of centralized package management.