npm package storage: 590 versions, ~12GB — risk of policy action

Problem

The mashlib npm package currently has 590 published versions totaling an estimated ~12GB on the npm registry (each build is ~21MB unpacked).

The growth has accelerated sharply:

That's 199 versions in ~14 months, compared to 10 in the entirety of 2024.

Risk

npm monitors package storage and has taken action against packages for excessive registry usage. With 14 maintainers listed on this package, a policy action would affect everyone.

Suggested fixes

1. Add a version-exists check to CI so it doesn't publish if the version already exists on npm
2. Stop publishing prerelease/hash versions (e.g. 2.1.4-test.0, 3.0.1-0dd33a6) to the public registry — use a local artifact or GitHub Packages instead
3. Consider deprecating the hundreds of unused prerelease versions to signal they are not intended for consumption
4. Review the CI pipeline to ensure publishes only happen on tagged releases from main

Context

This is a shared infrastructure concern that affects all 14 npm maintainers. The goal is to prevent further storage growth and reduce the risk of npm taking action against the package.

cc @jeswr @timea-solid

The issue names no specific files or tests; start by reviewing the CI pipeline, tagged-release flow, and npm publication configuration, then compare them with the listed prerelease and hash versions. Done means an agreed publishing policy prevents duplicate or unintended prerelease publishes, with any package cleanup decision documented.