Can't npm unpublish when a package has more than one versions

Nexus OSS 3.37.0-01, a hosted npm registry was setup.

When we unpublished a package with more than one version, an E500 error happened.

But if we --force unpublish the package or unpublish a package with only one version, everything goes fine.

The error was about metadata of the package:

java.lang.IllegalStateException: Package test-nexus lacks tarball version 0.1.1

Actually the tarball of test-nexus@0.1.1 is already in the registry, and can be found in the NRM. The problem here maybe relate with the code below, which may not retrieve the metadata of package successfully.

// NpmHostedFacetImpl.updateDeprecationFlags