2 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
This tool, called "undelete," allows users to recover packages removed from NPM and PyPI by querying secondary mirrors that might still have cached versions. It also retrieves package metadata, which is helpful for security researchers investigating malicious deletions. The command-line utility requires Node.js 14 or higher.
If you do, here's more
The "undelete" package allows users to recover deleted packages from the NPM and PyPI registries. When packages are removed, often due to security issues like malware, they can be hard to retrieve. This tool works by checking secondary NPM mirrors, particularly those in China, such as cnpmjs and npmmirror. For Python packages, it uses ecosyste.ms to access files.pythonhosted.org, which sometimes still have cached versions. This capability is especially useful for security researchers who need to analyze malicious packages that have been taken down.
To use the undelete package, you need Node.js version 14 or higher. The installation is straightforward with the command `npm install undelete`. Once set up, users can specify the registry and package name along with various options, like the number of versions to download or the directory to save files. For example, typing `undelete npm express` retrieves the latest five versions of the Express package. The tool can also fetch package metadata, providing details such as maintainer information, which is vital for research into removed packages.
Metadata retrieval can be done in a human-readable format or as JSON, suitable for scripting. Commands like `undelete npm express --data` will show maintainer details, while `undelete npm mayhem-wma --data --silent` suppresses logs for a cleaner output. The JSON output includes specific information about the package, like its version, description, maintainer email, and repository link, which are essential for deeper analysis. The tool was created by the user 6mile, and contributions are welcome on its GitHub page.
Questions about this article
No questions yet.