At the moment we always merge the downloaded package root with previously cached content. This can end up leaving bad entries in the cache even after they have been removed from the upstream proxy.
The most likely reason package versions were removed from the remote is due to the package author unpublishing them. End users should examine the associated package SCM repository commit history to look for a note of such an action.
NEXUS-8625 also describes another scenario where Nexus can end up with bad metadata.
Expected: Replace the cached metadata content with the new downloaded content.