Is there a workaround for `npm publish -f`

You can unpublish a specific version, and then republish it:

npm unpublish [email protected]

And then republish the version.

This works indefinitely if the module is hosted on your own npm repo, but according to this, there's a time-limit (72 hours) in which you can do it if hosted on registry.npmjs.org.

someone said this on npm's github issue:

@nmrony You cannot overwrite previously-published packages anymore (since February 2014, if I recall correctly).

https://github.com/npm/npm/issues/8305#issuecomment-236412989

According to npm docs this unpublished versions cannot be republished,bump a patch version and publish

Once a package is unpublished, it cannot be republished. If you’ve unpublished a package by mistake, we’d recommend publishing again under a different name, or for unpublished versions, bumping the version number and publishing again.

So:

npm unpublish
npm version patch
npm publish

will do the job.