[byte1918]

The NPM fiasco should no longer be possible

If you want to unpublish a package after 72 hours have passed, contact npm Support. For more information about why we don’t allow users to unpublish packages after 72 hours, see our unpublish policy.

https://docs.npmjs.com/unpublishing-packages-from-the-regist...

[celticninja]

Could you just publish garbage instead?

[yoz-y]

You could but everybody uses version pinning in production, right?

[emsy]

People who are serious about reproducible builds host their own repos. Most people probably don’t know the difference between ^1.0.1 and ~1.0.1

[bakuninsbart]

Thanks for making me look that up!

[delfinom]

If only npm's version pinning actually version pinned without idiotic subrules. package-lock.json is just one massive lie.

[minitech]

What do you mean?

[jpangs88]

Versioned garbage, but yeah you could. It would just make a new version not work which isn't as harmful as taking away a package.

[leppr]

It was never possible without "admin" intervention. That whole inccident was NPM's sole responsibility.

[minitech]

That’s… plainly wrong. `npm unpublish --force your-package` would really just unpublish your package.

[leppr]

Okay that's embarrassing thanks. Hard to believe it took so long before being the left-pad debacle happened.

[precisioncoder]

Doesn't the code still technically belong to you? Can't you submit a takedown request?

[jrockway]

It belongs to you but you distributed it with a license that gives away some of your rights.

[Crinus]

Not sure how npm works in detail, doesn't it pull directly from devs' repositories? In that case can't the devs just publish an update that breaks everything?

[julianwachholz]

This wouldn't be as big of a problem with version pinning.

[parsimo2010]

npm allows for installation of specific versions. So even if a dev publishes a new version that breaks you can select a previous version known to work. A good dev shouldn’t be updating willy-nilly to the latest version just because it’s the latest. They ought to spec a particular version and update after testing.

[monocasa]

Doesn't npm allow a dev to replace or redact already released versions?