Can't npm unpublish when a package has more than one versions

Sonatype Nexus Repository
1

Nexus OSS 3.37.0-01, a hosted npm registry was setup.

When we unpublished a package with more than one version, an E500 error happened.

image
image2074×1516 480 KB

But if we --force unpublish the package or unpublish a package with only one version, everything goes fine.

The error was about metadata of the package:

java.lang.IllegalStateException: Package test-nexus lacks tarball version 0.1.1
	at com.google.common.base.Preconditions.checkState(Preconditions.java:826)

Actually the tarball of test-nexus@0.1.1 is already in the registry, and can be found in the NRM. The problem here maybe relate with the code below, which may not retrieve the metadata of package successfully.

// NpmHostedFacetImpl.updateDeprecationFlags
packageRoot.child(NpmMetadataUtils.VERSIONS)