Soft deletes. You can delete a package and it stops being advertised but a shadow copy of referenced versions are kept for anything that depends on it. NPM spews warnings when this happens.

Once the referencing packages are updated are deleted or modified the shadow versions can be dropped.