The author explicitly chooses an open source license and publishes to a public repository for other people to depend on. That action releases the package into t

The author explicitly chooses an open source license and publishes to a public repository for other people to depend on. That action releases the package into the public sphere. If the author then wants to undo this action, that simply will be difficult—more so the more people depend on the package. If several people depend on the package, then they will try to put it back again, unless they sympathize strongly with the author's intention to unpublish. That's just open source working as intended. There's no ethical framework that compels people to have that sympathy, in general.