someone did an `npm publish` without having either `private: true` or a separate private registry config set in the package.json.

You CAN unpublish it's sort of not easy since replication.