IIRC there is a package whose whole point is to include everything else in its package.json and make them ineligible for unpublish.