Recovering a removed npm malware file using Software Heritage and a surviving CDN digest

The investigation focused on the scoped npm package @goodjavascript/[email protected], whose malware-laden entry-point file was removed from npm and jsDelivr CDN, returning 404 errors. Using Software Heritage archival snapshots, an older version of the package containing the original 840-byte index.js file was found. The SHA-256 hash of this file matched a digest still listed in jsDelivr's file manifest, confirming its authenticity. Static code analysis revealed a timer that collects host information and executes JavaScript supplied by a remote server, indicating malicious behavior. The package lacked installation scripts and had an empty exported config function, suggesting the malicious payload was triggered at runtime. The researcher provided detailed recovery steps, dated evidence, annotated code excerpts, and a Python script to verify the file's integrity without executing it. This work contributes to the existing OSV advisory on this malware.

The malicious package could collect host information and execute arbitrary JavaScript code supplied by a remote server, potentially enabling remote code execution or data exfiltration on affected systems. Since the package was removed from npm and CDN sources, the risk of new infections is reduced, but systems that previously installed the package may remain compromised if not remediated. No active exploits in the wild are reported. The malware's stealthy design (no install scripts, empty exported function) could have delayed detection.

The malicious package @goodjavascript/[email protected] has been removed from npm and CDN sources, reducing exposure. Users should verify their dependencies to ensure this package is not present. Since the package is removed, no direct patch exists. The recovery and analysis provided can assist in forensic investigations. No additional vendor advisories or patches are indicated. Users should rely on existing OSV advisories and remove any instances of the malicious package from their environments.