Repository navigation
[BUG] npm unpublish for specific version got unpublished the whole package #4924
Closed as not planned
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
Hello,
I have tried to unpublish the specific version ( maybe the first version of the package to publish ) to hide the insecure package that had some vulnerability for it.
I have done this right after publishing the patched version, the command looked like
$ npm publish
npm notice
npm notice package: check-tor-connection@1.0.1
npm notice === Tarball Contents ===
npm notice 1.1kB LICENSE
npm notice 3.4kB README.md
npm notice 367B config.example.json
npm notice 1.1kB package.json
npm notice 2.8kB src/index.js
npm notice 69B src/start.js
npm notice === Tarball Details ===
npm notice name: check-tor-connection
npm notice version: 1.0.1
npm notice filename: check-tor-connection-1.0.1.tgz
npm notice package size: 3.7 kB
npm notice unpacked size: 8.8 kB
npm notice shasum: 0a740ba58f8f4fe12473a68d262a67f461a77cc0
npm notice integrity: sha512-gSdGdIxGotNb5[...]yUQp02rZPHsCg==
npm notice total files: 6
npm notice
npm notice Publishing to https://registry.npmjs.org/
+ check-tor-connection@1.0.1
$ npm unpublish check-tor-connection@1.0.0
- check-tor-connection@1.0.0So everything went normal until I have found that it resulted to pull down the whole package which seems to be a nonsense.
Could you check this package https://www.npmjs.com/package/check-tor-connection and find out what happened to it?
Thanks.
Expected Behavior
Unpublishing the specific vulnerable package should not result in pulling down the whole repository
Steps To Reproduce
$ npm publish
npm notice
npm notice package: check-tor-connection@1.0.1
npm notice === Tarball Contents ===
npm notice 1.1kB LICENSE
npm notice 3.4kB README.md
npm notice 367B config.example.json
npm notice 1.1kB package.json
npm notice 2.8kB src/index.js
npm notice 69B src/start.js
npm notice === Tarball Details ===
npm notice name: check-tor-connection
npm notice version: 1.0.1
npm notice filename: check-tor-connection-1.0.1.tgz
npm notice package size: 3.7 kB
npm notice unpacked size: 8.8 kB
npm notice shasum: 0a740ba58f8f4fe12473a68d262a67f461a77cc0
npm notice integrity: sha512-gSdGdIxGotNb5[...]yUQp02rZPHsCg==
npm notice total files: 6
npm notice
npm notice Publishing to https://registry.npmjs.org/
+ check-tor-connection@1.0.1
$ npm unpublish check-tor-connection@1.0.0
- check-tor-connection@1.0.0Environment
- npm: 8.5.5
- Node.js: v16.15.0
- OS Name: Windows
- System Model Name:
- npm config:
; copy and paste output from `npm config ls` here
Activity