Also having this problem with both npm unpublish and npm deprecate!

$ npm deprecate --force --verbose [email protected] "Generates errors related to exports in the browser, use 1.2.2 or newer"
...
npm http fetch GET 200 https://registry.npmjs.org/luar?write=true 328ms
npm http fetch PUT 404 https://registry.npmjs.org/luar 98ms
npm verb stack Error: 404 Not Found - PUT https://registry.npmjs.org/luar - Not found
npm verb stack     at /usr/lib/node_modules/npm/node_modules/npm-registry-fetch/check-response.js:114:15
npm verb stack     at processTicksAndRejections (internal/process/task_queues.js:93:5)
npm verb statusCode 404
npm verb pkgid [email protected]
...
npm ERR! code E404
npm ERR! 404 Not Found - PUT https://registry.npmjs.org/luar - Not found
npm ERR! 404 
npm ERR! 404  '[email protected]' is not in the npm registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404 
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.
...
$ npm unpublish --force --verbose [email protected]
...
npm http fetch GET 200 https://registry.npmjs.org/luar?write=true 257ms
npm http fetch PUT 404 https://registry.npmjs.org/luar/-rev/5-260b27ca1cdb4a5d3b4175578e1c0300 99ms
npm verb stack Error: 404 Not Found - PUT https://registry.npmjs.org/luar/-rev/5-260b27ca1cdb4a5d3b4175578e1c0300 - Not found
npm verb stack     at /usr/lib/node_modules/npm/node_modules/npm-registry-fetch/check-response.js:114:15
npm verb stack     at processTicksAndRejections (internal/process/task_queues.js:93:5)
npm verb statusCode 404
npm verb pkgid [email protected]
...
npm ERR! code E404
npm ERR! 404 Not Found - PUT https://registry.npmjs.org/luar/-rev/5-260b27ca1cdb4a5d3b4175578e1c0300 - Not found
npm ERR! 404 
npm ERR! 404  '[email protected]' is not in the npm registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404 
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.
...

Having the same issue when running npm deprecate - getting back a 404 Not Found. The cause was because I wasn't authenticated correctly (npm adduser sorted it out) - but the Not Found output leads you off on tangents. Even if there's no possibility for the server API to return a different status code (such as a 401), some output from these commands to suggest logging in would be good. The output could be generic and always shown ("make sure you're logged in!") or could be shown if you don't have an authToken present.

But I am logged in! This is in the exact same terminal session where I just published a new version as the owner of the package

Oops! Nevermind that, I just logged out and logged back in and now both functions work, weird, sorry for the confusion!

@luawtf Ah, in that case, it sounds like this is the same situation as mine -- these commands displaying 404 Not Found when the actual issue is authentication-related.

Yep! I agree that a more general and verbose error would be great.
Also, why does the registry return a 404 when a 401 Unauthorized would make more sense, shouldn't that also be fixed?

Agreed. Seems odd for packages that are already public -- there's nothing to be gained security-wise by returning a 404 rather than 401 in this case. It would make sense if a package was private, much like how GitHub shows a 404 if you try and access a private repo when logged out so as to not give away the fact there's anything at all at that URL.

I can confirm the issue was that I was not logged in.
Returning a 401 or having a message warning about not being logged in both sound good to me.

we ran into this with a public package as well. npm unpublish @scope/package@version --verbose shows a 404, but otherwise the unpublish appears to be successful

I have the same problem, being unable to deprecate a package of mine. I assumed it had something to do with the package being scoped, since I noticed that the slash in the package name is shown as %2f in the URL, but I really don't understand what's going on.

$ node -v
v14.15.0
$ npm -v
6.14.8
$ npm deprecate @alling/foo-bar "This package should not be used."
npm ERR! code E404
npm ERR! 404 Not Found - PUT https://registry.npmjs.org/@alling%2ffoo-bar - Not found
npm ERR! 404 
npm ERR! 404  '@alling/foo-bar@latest' is not in the npm registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404 
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.

@SimonAlling what happens with npm v7.0.11?

@SimonAlling what happens with npm v7.0.11?

$ docker run -it node bash
# npm -v
7.0.8
# npm login
Logged in as alling on https://registry.npmjs.org/.
npm notice 
npm notice New patch version of npm available! 7.0.8 -> 7.0.11
npm notice Changelog: https://github.com/npm/cli/releases/tag/v7.0.11
npm notice Run npm install -g [email protected] to update!
npm notice 
# npm deprecate nonexisting-package-asdfasdf LOL
npm ERR! code E404
npm ERR! 404 Not Found - GET https://registry.npmjs.org/nonexisting-package-asdfasdf?write=true
npm ERR! 404 
npm ERR! 404  'nonexisting-package-asdfasdf@latest' is not in the npm registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404 
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.
# npm deprecate @alling/foo-bar "This package should not be used."

No error or other output, but no deprecation message showed up on the package page (i.e. https://www.npmjs.com/package/@alling/foo-bar), even after like half an hour, so I tried running the command again:

# npm deprecate @alling/foo-bar "This package should not be used."
npm ERR! code E422
npm ERR! 422 Unprocessable Entity - PUT https://registry.npmjs.org/@alling%2ffoo-bar - Unprocessable Entity

However, if I go to a specific version of the package (e.g. https://www.npmjs.com/package/@alling/foo-bar/v/1.1.6), I see the expected deprecation message*. But I want it to show up on the main package page as well (like e.g. urix).

* Latest version: _This package has been deprecated_. Any other version: _This version has been deprecated_.

EDIT: The deprecation message finally showed up on the main package page.

That’s using npm v7.0.8; can you npm install -g npm@7 before running the deprecate command?

The deprecation message finally appeared on the main package page, so I believe it works with npm v7.0.8. :slightly_smiling_face: