[yreg]

> The "everything" package, with its 5 sub-packages and thousands of dependencies, has essentially locked down the ability for authors to unpublish their packages. This situation is due to npm's policy shift following the infamous "left-pad" incident in 2016, where a popular package left-pad was removed, grinding development to a halt across much of the developer world. In response, npm tightened its rules around unpublishing, specifically preventing the unpublishing of any package that is used by another package.

Has no one thought of that? It seems like it should have been obvious that such an absolute rule could be easily abused to troll the system at scale.

Not sure if it's a problem though, perhaps all unpublishing requests should be reviewed by someone at the registry (and granted only when it makes sense).

[yoavm]

I guess that's what happens when your whole ecosystem is an afterthought?

[yreg]

But this was a rule that was devised in response to a specific problem in the ecosystem…