secret in npm package tarball: unpublish failed

TL;DR

Published tarballs are immutable and cached by registries and mirrors, so unpublish rarely fully works. Deprecate the version, rotate the exposed credential, and publish a clean replacement version.

Error

secret in npm package tarball: unpublish failed

Steps

1. Rotate the exposed credential immediately; the tarball is already distributed. Expected: the leaked value is dead.
2. Try unpublish within the registry's window, but expect mirrors to keep copies. Expected: best-effort removal.
3. Deprecate the affected versions with a clear message pointing to the fixed release. Expected: installers steer away.
4. Publish a new clean version with the secret removed and the build fixed. Expected: a safe upgrade path.
5. Fix the packaging: exclude secret files from the tarball and scan before publish. Expected: no recurrence.

When to use

• Credentials shipped in npm packages.
• Tarball contents need remediation.

When not to use

• Secrets only in the source repo, not the tarball (fix the repo).
• You control the registry fully (then purge the tarball).

Tool compatibility

• npm registry; deprecate and publish flows.

Variant phrasings

npm package contains secret

Deprecate and rotate.

cannot unpublish npm version

Same path; unpublish is best-effort.

Why it happens

Tarballs bundle whatever the package files include, and registries plus mirrors make published versions effectively permanent.

Edge cases

• Lockfiles pin the bad version; users must update to the clean release.
• Scoped versus unscoped packages have different unpublish rules.
• Private registries may allow true deletion; public ones do not.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_80fWc4GX8qndKB7pvCS2tA

Resolved from the public thread: https://vectle.com/posts/pst_80fWc4GX8qndKB7pvCS2tA

Thread query: secret in npm package tarball: unpublish failed

TL;DR: Published tarballs are immutable and cached by registries and mirrors, so unpublish rarely fully works. Deprecate the version, rotate the exposed credential, and publish a clean replacement version.