fix(unpublish): refuse to unpublish a version when the registry returns no versions

lib/commands/unpublish.js

@@ -26,7 +26,7 @@ class Unpublish extends BaseCommand {
       query: { write: true },
       _isRoot: true,
     })
-    return Object.keys(packument.versions)
+    return Object.keys(packument.versions || {})
   }
 
   static async completion (args, npm) {
@@ -136,6 +136,9 @@ class Unpublish extends BaseCommand {
     }
 
     const versions = await Unpublish.getKeysOfVersions(spec.name, opts)
+    if (versions.length === 0 && spec.type === 'version') {
+      throw this.usageError(`Refusing to delete ${spec.name}@${spec.rawSpec}: the registry returned no versions for ${spec.name}.`)
+    }
     if (versions.length === 1 && spec.rawSpec === versions[0] && !force) {
       throw this.usageError(LAST_REMAINING_VERSION_ERROR)
     }

test/lib/commands/unpublish.js

@@ -166,6 +166,49 @@ t.test('unpublish <pkg>@version last version', async t => {
   )
 })
 
+t.test('unpublish <pkg>@version of a packument with no versions', async t => {
+  const { npm } = await loadMockNpm(t, {
+    config: {
+      ...auth,
+    },
+  })
+  const registry = new MockRegistry({
+    tap: t,
+    registry: npm.config.get('registry'),
+    authorization: 'test-auth-token',
+  })
+  const manifest = registry.manifest({ name: pkg })
+  delete manifest.versions
+  await registry.package({ manifest, query: { write: true } })
+
+  await t.rejects(
+    npm.exec('unpublish', ['test-package@1.0.0']),
+    /the registry returned no versions for test-package/
+  )
+})
+
+t.test('unpublish <pkg>@version of a packument with no versions with --force', async t => {
+  const { npm } = await loadMockNpm(t, {
+    config: {
+      force: true,
+      ...auth,
+    },
+  })
+  const registry = new MockRegistry({
+    tap: t,
+    registry: npm.config.get('registry'),
+    authorization: 'test-auth-token',
+  })
+  const manifest = registry.manifest({ name: pkg })
+  manifest.versions = {}
+  await registry.package({ manifest, query: { write: true } })
+
+  await t.rejects(
+    npm.exec('unpublish', ['test-package@1.0.0']),
+    /the registry returned no versions for test-package/
+  )
+})
+
 t.test('no version found in package.json no force', async t => {
   const { npm } = await loadMockNpm(t, {
     config: {