Published packages should be immutable. Sure, "unpublish" so it's no longer listed. Even display scary messages in your package manager's stdout. But once you publish a package, any package manager with the hash of the package contents in its lockfile should be able to continue retrieving it indefinitely. The fact that it's possible for any maintainer to break all consumers of their previously published works on a whim is insane to me.