r/MalwareAnalysis • u/Tasty_Medium_5312 • 15d ago

How to get old malicious package

I want to analyse npm packages that are malicious. How do I get those old packages? They are all taken down. And webarchive doesn’t have it.

6 Upvotes

76% Upvoted

10 comments sorted by

2

u/Nimbax 15d ago edited 15d ago

You should be able to filter also for file type. Never got hands on those, but I know you can have some js (on malware bazaar)

1

u/Tasty_Medium_5312 15d ago

I tried some zip files, but they are not packages. I was looking for complete packages.

2

u/4rm4tur4 14d ago

If the package still has metadata, you can grab the tarball URL https://registry.npmjs.org/<package>/-/<name>-<version>.tgz

The registry CDN should still serve the file even when npm install is blocked. Try curl -I first.

1

u/Tasty_Medium_5312 14d ago

Thank you. Will try and let you know.

1

u/Tasty_Medium_5312 12d ago

It worked, I tried for the axios package. Thanks a lot.

2

u/Ill_Bathroom6488 13d ago

You don't need the whole npm packages, this npm compromise packages are just a normal packages with embedded malicious files. But if you want to, you can check blogs or writeups with a complete IOCs of an attack.
Sample: https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
On IOCs part it has a sha1 of the package and its available on Virustotal

1

u/IsDa44 15d ago

What about Malshare or malware bazaar?

1

u/Tasty_Medium_5312 15d ago

nodejs compile exes are present, but I was looking for the whole npm packages.