__ __ __
__ ______ ____/ /__ / /__ / /____
/ / / / __ \/ __ / _ \/ / _ \/ __/ _ \
/ /_/ / / / / /_/ / __/ / __/ /_/ __/
\__,_/_/ /_/\__,_/\___/_/\___/\__/\___/
This package "undeletes" a package that has been deleted from the NPM registry. How does it do that? Well, magic of course! No, no ... on the serious tip, the undelete function works by checking secondary NPM mirrors and pulling the files from their cache. This package will also undelete the package metadata which will tell you the NPM user, email and other metadata that's helpful for research purposes.
When packages are removed from NPM or PyPI (often due to malware detection), they become unavailable through normal channels. This tool recovers those packages by:
- NPM: Querying Chinese mirror servers (cnpmjs, npmmirror, Huawei, Tencent) that may still have cached copies
- PyPI: Using ecosyste.ms which indexes
files.pythonhosted.orgURLs that often remain accessible
This is particularly useful for security researchers analyzing malicious packages that have been taken down.
npm install undeleteundelete <registry> <package-name> [options]Requires Node.js 14+.
undelete <registry> <package-name> [options]| Registry | Description |
|---|---|
npm |
NPM (npmjs.org) packages |
pypi |
PyPI (pypi.org) Python packages |
| Option | Description |
|---|---|
-n, --number <count> |
Number of versions to download (1-20, default: 5) |
-p, --path <directory> |
Save downloaded packages to specified directory (default: current directory) |
-d, --data |
Get package metadata instead of downloading files |
-s, --silent |
Silent mode - outputs JSON for --data, suppresses logs otherwise |
-h, --help |
Display help message |
-v, --version |
Show version |
# Download latest 5 versions of an NPM package
undelete npm express
# Download specific number of versions
undelete npm @angular/core -n 10
# Download to a specific directory
undelete npm lodash --path ./downloads
# Download PyPI package
undelete pypi requests
# Download PyPI package with options
undelete pypi flask -n 3 -p ./malware_samplesThe --data flag retrieves package metadata including maintainer information, which is useful for investigating removed malicious packages.
# Human-readable output
undelete npm express --data
# JSON output (for scripting)
undelete npm mayhem-wma --data --silent
# PyPI metadata
undelete pypi some-package --data -s{
"package": "mayhem-wma",
"version": "1.0.1",
"description": "Mayhem WMA - A professional utility package...",
"npmUser": "petternilssonorg",
"npmUserEmail": "[email protected]",
"maintainers": [
{
"name": "petternilssonorg",
"email": "[email protected]"
}
],
"repository": "https://github.com/kinexbt/mayhem-wma",
"license": "MIT",
"downloads": null,
"dependentPackages": 0,
"dependentRepos": 0,
"firstPublished": "2025-11-20T00:05:31.566Z",
"lastPublished": "2025-11-20T00:05:31.566Z",
"isSecurityPlaceholder": true
}MIT
Created by 6mile
Issues and pull requests welcome at github.com/6mile/undelete