How to fix npm ERR! code E405 npm ERR! 405 Method Not Allowed - Cannot unpublish after 72 hours in npm

npmBEGINNERMEDIUMUpdated Dec 5, 2025· 209 views

npm prevents unpublishing packages published more than 72 hours ago unless specific criteria are met. This policy exists to maintain Node.js ecosystem stability and prevent breaking changes that could impact thousands of dependent projects.

Quick fix

Fixes npm ERR! code E405 npm ERR! 405 Method Not Allowed - Cannot unpublish after 72 hours

# Deprecate entire package
npm deprecate your-package "This package is deprecated. Please use alternative-package instead."

# Deprecate specific version
npm deprecate your-package@1.0.0 "Version 1.0.0 has security vulnerabilities. Please upgrade."

# Undeprecate (remove deprecation)
npm deprecate your-package ""
  1. Check if your package meets unpublish criteria
  2. Use npm deprecate as the recommended alternative
  3. Attempt unpublish within 72-hour window
  4. Contact npm support for exceptions
npm — error
# Deprecate entire package
npm deprecate your-package "This package is deprecated. Please use alternative-package instead."
# Deprecate specific version
npm deprecate your-package@1.0.0 "Version 1.0.0 has security vulnerabilities. Please upgrade."
# Undeprecate (remove deprecation)
npm deprecate your-package ""
npm ERR! code E405
npm ERR! 405 Method Not Allowed - Cannot unpublish after 72 hours

What this error means

npm prevents unpublishing packages published more than 72 hours ago unless specific criteria are met. The E405 error occurs when you attempt to unpublish a package that exceeds this window or fails to meet npm's ecosystem-protection requirements. This policy exists to maintain Node.js ecosystem stability and prevent breaking changes that could impact thousands of dependent projects. It was implemented following the infamous "left-pad" incident (2016), where unpublishing a widely-used utility package broke thousands of JavaScript projects ecosystem-wide. After 72 hours, you can only unpublish if your package has: - Zero dependent packages in npm registry - Fewer than 300 downloads in the past week - A single owner/maintainer

Typical symptoms

  • Error message: 'npm ERR! code E405' or '405 Method Not Allowed'
  • Unable to execute 'npm unpublish' command for older package versions
  • Error appears when trying to remove a package published more than 72 hours ago
  • npm CLI returns 'You can no longer unpublish this package' message

Common causes

  1. Package was published more than 72 hours ago and has dependent packages
  2. Package has more than 300 downloads in the past week
  3. Package has multiple owners/maintainers
  4. Other packages in the npm Public Registry depend on your package
  5. npm policy enforces 72-hour unpublish window to prevent ecosystem breakage

How to fix "npm ERR! code E405 npm ERR! 405 Method Not Allowed - Cannot unpublish after 72 hours"

1Check if your package meets unpublish criteria

Verify if your package qualifies for unpublishing after 72 hours:

- Has zero dependent packages in npm registry
- Has fewer than 300 downloads in the past week
- Has a single owner/maintainer

Check dependencies using npm's package page: https://npmjs.com/package/{your-package}

2Use npm deprecate as the recommended alternative

If your package doesn't meet unpublish criteria, deprecate it instead:

bash
# Deprecate entire package
npm deprecate your-package "This package is deprecated. Please use alternative-package instead."

# Deprecate specific version
npm deprecate your-package@1.0.0 "Version 1.0.0 has security vulnerabilities. Please upgrade."

# Undeprecate (remove deprecation)
npm deprecate your-package ""

Deprecation warns users during install and removes the package from search results without breaking existing installations.

3Attempt unpublish within 72-hour window

If you're within 72 hours of publishing and have no dependents:

bash
npm unpublish your-package --force
# or unpublish specific version
npm unpublish your-package@1.0.0 --force

Note: Once unpublished, you cannot reuse that version number. You must publish a new version if republishing.

4Contact npm support for exceptions

If your package meets unpublish criteria but the command still fails:

1. Visit npm support: https://support.npmjs.com
2. Submit a request explaining your situation
3. Include evidence that your package meets criteria
4. Wait for npm support team response

Manual review is available for edge cases like security vulnerabilities or account compromises.

5Transfer package to @npm account if unmaintained

If you no longer maintain a package but others depend on it:

bash
npm owner add npm your-package
npm owner rm your-username your-package

This transfers ownership to npm's official account. After transfer, you cannot update the package, but it remains available and safe in the registry.

Advanced notes

The left-pad incident: In 2016, a developer unpublished his popular "left-pad" package (11 lines of code), breaking thousands of projects including major frameworks. This incident prompted npm to implement strict unpublish policies.

Version immutability: Package versions are immutable once published—even if unpublished, that version number can never be reused.

24-hour republish moratorium: Unpublishing all versions of a package triggers a 24-hour period where you cannot republish under that name.

Deprecation vs unpublish: Deprecation is superior for most scenarios because it provides user warning, maintains ecosystem continuity, and allows gradual migration.

Frequently asked questions

What does "npm ERR! code E405 npm ERR! 405 Method Not Allowed - Cannot unpublish" mean?
npm prevents unpublishing packages published more than 72 hours ago unless specific criteria are met. The E405 error occurs when you attempt to unpublish a package that exceeds this window or fails to meet npm's ecosystem-protection requirements. js ecosystem stability and prevent breaking changes that could impact thousands of dependent projects.
How do I fix "npm ERR! code E405 npm ERR! 405 Method Not Allowed - Cannot unpublish"?
npm prevents unpublishing packages published more than 72 hours ago unless specific criteria are met. This policy exists to maintain Node.js ecosystem stability and prevent breaking changes that could impact thousands of dependent projects.
What causes "npm ERR! code E405 npm ERR! 405 Method Not Allowed - Cannot unpublish"?
Package was published more than 72 hours ago and has dependent packages Package has more than 300 downloads in the past week Package has multiple owners/maintainers
Is the "npm ERR! code E405 npm ERR! 405 Method Not Allowed - Cannot unpublish" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading