Laurie Voss

Un-un-publishing is an unprecedented action that we're taking given the severity and widespread nature of breakage, and isn't done lightly.

This action puts the wider interests of the community of npm users at odds with the wishes of one author; we picked the needs of the many.

Even within npm we're not unanimous that this was the right call, but I cannot see hundreds of builds failing every second and not fix it.

left-pad@0.0.3 is now restored to the registry. Run npm cache clear before attempting your installs again. This sucked and we're sorry.

This whole situation sucks. We will be carefully considering the issues raised by and publishing a post-mortem later.

In the meantime, several thousand open source projects have been repaired, and I'm sleeping fine tonight.

@seldo @npmjs Is that really your choice to make?

@JakeDChampion The package name was adopted by @camwest, who asked us to do this, but we acknowledge it's a very grey area.

@seldo @camwest Is this in your TOS somewhere?

@JakeDChampion The TOS say anybody can adopt a package name that has been abandoned; that part is routine.

@seldo The other part is what I meant, the un unpublishing

@JakeDChampion The TOS don't really address this situation. It's never happened before, so we never considered it.

@seldo This section makes me think it isn't within NPMJS' rules to un unpublish -- https://www.npmjs.com/policies/open-source-terms#your-content …

@seldo It would make a lot more sense if npm was immutable, all you could do is publish new stuff and not remove or change existing stuff.

@DaleJefferson it is immutable with the exception of being able to unpublish stuff, and up until now that's always been useful.

@seldo seems the unpublishing thing is a major security risk? Should unpublishing not be allowed after some period of time?

@miranext we're (re)considering our policy carefully.