Stray `[email protected]` on npm sorts above the real release line and gets picked by version-list resolvers (mise)

Summary

[email protected] through [email protected] were published to npm on 2026-04-08, while the actual release line is still 1.2.x (latest dist-tag is currently 1.2.4).

Because 1.3.1-3 semver-sorts above every 1.2.x release, any tool that resolves "latest" from the version list instead of the latest dist-tag installs 1.3.1-3. Plain npm i -g happy is unaffected because it follows the dist-tag.

Reproduction

# mise.toml
[tools]
"npm:happy" = "latest"

$ mise install npm:happy
$ mise ls npm:happy
npm:happy  1.3.1-3

Compare:

$ npm view happy dist-tags
{ latest: '1.2.4', beta: '1.2.5-beta.1' }

mise's npm backend only filters prerelease suffixes that look like alpha/beta/rc; a purely numeric -3 suffix passes through.

Suggested fix

Deprecate or unpublish the 1.3.1-* versions, e.g.:

npm deprecate happy@"1.3.1-0 - 1.3.1-3" "Accidental publish; use 1.2.x"

Future prereleases would be safer with a named tag (1.3.0-beta.0), which most resolvers already treat as unstable.

Workaround

Pin to the 1.2 line: "npm:happy" = "1.2".