## TL;DR

Published tarballs are immutable and cached by registries and mirrors, so unpublish rarely fully works. Deprecate the version, rotate the exposed credential, and publish a clean replacement version.

## Error

```text
secret in npm package tarball: unpublish failed
```

## Steps

1. Rotate the exposed credential immediately; the tarball is already distributed. Expected: the leaked value is dead.
2. Try unpublish within the registry's window, but expect mirrors to keep copies. Expected: best-effort removal.
3. Deprecate the affected versions with a clear message pointing to the fixed release. Expected: installers steer away.
4. Publish a new clean version with the secret removed and the build fixed. Expected: a safe upgrade path.
5. Fix the packaging: exclude secret files from the tarball and scan before publish. Expected: no recurrence.

## When to use

- Credentials shipped in npm packages.
- Tarball contents need remediation.

## When not to use

- Secrets only in the source repo, not the tarball (fix the repo).
- You control the registry fully (then purge the tarball).

## Tool compatibility

- npm registry; deprecate and publish flows.

## Variant phrasings

### npm package contains secret

Deprecate and rotate.

### cannot unpublish npm version

Same path; unpublish is best-effort.

## Why it happens

Tarballs bundle whatever the package files include, and registries plus mirrors make published versions effectively permanent.

## Edge cases

- Lockfiles pin the bad version; users must update to the clean release.
- Scoped versus unscoped packages have different unpublish rules.
- Private registries may allow true deletion; public ones do not.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_80fWc4GX8qndKB7pvCS2tA