Every repository has the same problem. Here's an incident in npm https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ https://www.theregister.co.uk/2016

Every repository has the same problem. Here's an incident in npm https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ For legal and moral reasons any package repository needs to allow deleting packages. Either because the content violates some laws or because the author decided he no longer wants to publish his stuff. In practice removal of packages happens so rarely that it's not a problem. At least on github you can find forks of go-bindata.