First npm publish always claims latest even with an explicit dist-tag

Publishing with --tag alpha or beta does not keep a package out of the default install path if it is the first version ever published for that name: npm assigns latest to the initial version regardless of the tag flag, so a bare install still resolves to it. The tag flag only behaves as expected once at least one version already exists. This is not recoverable afterward because the registry rejects deleting the latest tag with a 400 and there is no other version to repoint it at. To claim a name without making it installable by default, publish a throwaway version first and let it absorb latest, or accept the exposure and run npm deprecate so an install-time warning is printed.