4 ms·
> Why are you unpublishing it in the first place? Just leave it alone and slap a deprecation notice on it. This doesn't work if you've accidentally published s
by richbell 3y ago
> Why are you unpublishing it in the first place? Just leave it alone and slap a deprecation notice on it.
This doesn't work if you've accidentally published sensitive information or files. Though I agree that deleting packages is generally not necessary.
- joshstrange 3y agoOTOH if you’ve published sensitive info the cat is out of the bag. Deleting the version is not the correct response, rotating creds is the only viable answer. I’m sure there are bots watching new versions posted to NPM, scanning them for things like AWS access keys or crypto wallet creds. I’d bet that if you publish a package with AWS creds you will have crypto miners launched on your account within the hour if not within 5 minutes (probably all automated).