[flagged]
Every competent repository has a process for unpublishing. Sooner or later someone will upload something that someone else claims the copyright to, and then either you take it down when you get a DMCA notice or you lose your safe harbour.
Maybe you replace it with some sort of tombstone. Maybe you warn all the reverse dependencies first. But you have to have a way to remove content.
No software developer or organisation will use a software repository that allows deletion of packages. That’s why it’s not a thing anymore.
If you think this “right” should exist, that’s a market niche for you to exploit. But you won’t, will you? Because like I said, no user wants this.
The point is that Azer didn't owe anybody anything; not even to know what he was doing. npm did.
That said, I'm glad the wake-up call came in such a relatively benign way.