NPM has been tightening up its publish and unpublish rules for over half a decade. https://thenewstack.io/the-kik-kerfuffle/

That GitHub is now the owner of NPM doesn't change that policy and maturing of the environment.

https://blog.npmjs.org/post/141577284765/kik-left-pad-and-np...

> We dropped the ball in not protecting you from a disruption caused by unrestricted unpublishing. We’re addressing this with technical and policy changes.