[BUG] Rapidly unpublishing multiple versions deletes entire package

[BUG] Rapidly unpublishing multiple versions deletes entire package

Description

When unpublishing multiple versions of a package in rapid succession using npm unpublish <pkg>@<version> --force, the entire package gets deleted after a few versions are removed, even though other versions should remain.

This appears to be a different manifestation of the issue reported in #7015 and #4924, but occurs even on npm 11.x where those fixes have been applied.

Steps To Reproduce

1. Publish a package with 6 versions (0.1.0 through 0.1.5)
2. Unpublish versions one by one in a loop, intending to keep 0.1.5
3. After ~3 versions are unpublished, the entire package returns 404

# Publish 6 versions
for v in 0.1.0 0.1.1 0.1.2 0.1.3 0.1.4 0.1.5; do
  npm pkg set version=$v
  npm publish --access public
done

# Verify all versions exist
npm view @lwmacct/251220-npm-pkg-monorepo-cli versions
# Output: [ '0.1.0', '0.1.1', '0.1.2', '0.1.3', '0.1.4', '0.1.5' ]

# Unpublish versions (keeping 0.1.5)
for v in 0.1.0 0.1.1 0.1.2 0.1.3 0.1.4; do
  npm unpublish "@lwmacct/251220-npm-pkg-monorepo-cli@$v" --force
done

Actual Output

Unpublishing cli@0.1.0...
- @lwmacct/251220-npm-pkg-monorepo-cli
Unpublishing cli@0.1.1...
- @lwmacct/251220-npm-pkg-monorepo-cli
Unpublishing cli@0.1.2...
- @lwmacct/251220-npm-pkg-monorepo-cli
Unpublishing cli@0.1.3...
npm error code E404
npm error 404 Not Found - GET https://registry.npmjs.org/@lwmacct%2f251220-npm-pkg-monorepo-cli?write=true - Not found

After unpublishing 3 versions, the entire package becomes 404. Versions 0.1.3, 0.1.4, and 0.1.5 should still exist but the whole package is gone.

Verification

npm view @lwmacct/251220-npm-pkg-monorepo-cli 2>&1
# Output: 404 Unpublished on 2025-12-20T16:54:51.221Z

Expected Behavior

Only the specified versions should be unpublished. Version 0.1.5 should remain available.

Environment

• npm: 11.6.4
• Node.js: 24.11.1
• OS: Linux 6.12.54-linuxkit (Docker/sandbox environment)

Additional Context

• This is NOT a workspace/monorepo configuration issue - the unpublish commands were run without workspace flags
• The package was published within 72 hours, so unpublish should be allowed
• Each individual npm unpublish pkg@version --force command succeeds until the package suddenly becomes 404
• This suggests a race condition or state corruption on the registry side when processing rapid sequential unpublish requests

Related Issues

• #7015 - npm unpublish --force <package-name>@<version> deletes all versions (CLOSED - fixed in npm 10.x)
• #4924 - npm unpublish for specific version got unpublished the whole package (CLOSED)

The fix in #7015 addressed workspace configuration handling, but this bug appears to be triggered by rapid sequential unpublish requests rather than workspace misconfiguration.

Suggested Workaround

Add delays between unpublish operations:

for v in 0.1.0 0.1.1 0.1.2; do
  npm unpublish "pkg@$v" --force
  sleep 5  # Wait for registry to stabilize
  npm view pkg versions  # Verify package still exists
done

Start by reproducing the failure with the npm unpublish loop in the issue, then trace the npm CLI unpublish entry point and compare the behavior with related issues #7015 and #4924. Determine whether the CLI or registry request sequence causes the package deletion; done means removing several versions rapidly leaves the remaining version available without a 404.