Is there a workaround for `npm publish -f`

You can unpublish a specific version, and then republish it:

npm unpublish myModule@1.2.3

And then republish the version.

This works if the module is hosted on your own npm repo, but for registry.npmjs.org, you won’t be able to reuse the version number after unpublishing, and there’s a time-limit (72 hours) after which you can no longer unpublish. See the npm Unpublish Policy.