Kai
If you don't unpublish your package…
If you don't unpublish your package from npmjs within 24 hours after publishing, then it will be impossible to do this in the future. This means your package will be there FOREVER. Their support will also reject all your attempts to remove it. I would recommend to every european citizen to raise a complaint against NPMJS and according to the new GDPR rules, they will be punished with 20 millions USD or 4% global revenue (which is higher). This evil company deserved this for their dirty practices.