Yes, with limits. With the right access you can delete a private package or version. A public package or version can be deleted only if no version has more than 5,000 downloads. Deleted packages can be restored within 30 days if the namespace is still free. Above that threshold you must contact GitHub Support.
The rules from GitHub's docs
| Case | Can you delete it? |
|---|---|
| Entire private package | Yes, with the required access |
| Specific version of a private package | Yes |
| Entire public package | Only if no version has more than 5,000 downloads |
| Specific public version | Only if that version has 5,000 downloads or fewer |
| Public package past the threshold | Contact GitHub Support |
| Restore after deletion | Within 30 days, and only if the namespace is not used by a new package |
GitHub also warns that deleting a public package may break projects that depend on it.
Why a download threshold exists
Deleting something many projects depend on breaks their builds. A threshold is a compromise between author control and downstream stability, the same trade off other registries make. Compare unpublish, yank and deprecate.
When you need a version gone
- Decide why. A secret in the package, a license problem, or a vulnerability need different responses.
- If a secret is inside, rotate it first. Deletion is not recall: anyone who pulled the version keeps a copy, and caches may too.
- Delete the version if the rules allow, or contact support if the threshold blocks you.
- Publish a fixed version with a higher number and tell consumers.
- Note the restore window. If you deleted by mistake, act within 30 days and before anyone else claims the name.
For consumers
Do not assume a package will stay. Keep a lockfile with hashes, mirror what you ship, and record in your SBOM the exact version that went into each release. If a version is later removed upstream, your record still says what you shipped. See what happens to your mirror when upstream removes a package.
Access control note
Who can delete is as important as whether they can. Keep delete rights for a small group, and prefer separate credentials for publishing and for deletion. For the broader pattern see release access controls.
Safeguard's SBOM and dependency scanning keeps a per build record of components, so a withdrawn version can be traced to the releases that used it. A free scan shows what it records for a project.
Quick check
Can I restore a deleted package?
Yes, within 30 days of deletion, provided the same namespace has not been used for a new package.
Can I delete a popular public package?
Not on your own. If any version has more than 5,000 downloads, GitHub directs you to its support portal.
Sources
Last reviewed: 19 October 2026.
