'everything' blocks devs from removing their own npm packages

Over the holidays, an npm package dubbed "everything" and 3,000+ scoped subpackages were published that collectively depend on every package in the npm registry, causing any install to pull millions of transitive dependencies—risking disk exhaustion—and, because of npm's dependency-based unpublish policy, temporarily blocking unrelated maintainers from unpublishing their packages; the author apologized and many of the packages were subsequently made private, easing the impact.