escape package names correctly for unpublishing