NPM & PyPI DevTools Package & Maintainer Intelligence

Get structured public package metadata for developer-tool research, dependency inventories and ecosystem monitoring. Search the official NPM Registry or supply explicit NPM/PyPI names, then export JSON or CSV to Clay, n8n or your own analytics workflow.

Price: $0.005 per successful unique package saved ($5 per 1,000). No start fee, no charge for missing packages, filtered-out candidates, duplicate names or failed metadata lookups. Standard run platform usage is included. Deduplication is per run, including resumed runs, by ecosystem plus canonical package name. New runs are separately billable. Statistics can be null while the metadata row is still a successful billable result.

Quick start

NPM defaults return five packages: eslint, typescript, prettier, vite and webpack.

{"ecosystem":"npm","packageNames":["eslint","typescript","prettier","vite","webpack"],"maxResults":5,"maxCostUsd":0.025}

NPM discovery:

{"ecosystem":"npm","keywords":["eslint"],"minWeeklyDownloads":1000,"maxResults":5,"maxCostUsd":0.025}

Reliable PyPI metadata mode (no statistics account or external statistics calls):

{"ecosystem":"pypi","packageNames":["ruff","pytest","requests"],"maxResults":3,"pypiStatsSource":"none","maxCostUsd":0.015}

Optional PyPI statistics (third-party API; maximum ten names/results):

{"ecosystem":"pypi","packageNames":["ruff"],"maxResults":1,"pypiStatsSource":"pypistats","maxCostUsd":0.005}

Feature support

Feature	NPM	PyPI
Explicit package names	Yes, including scoped packages	Yes; required
Keyword discovery	Official registry search	Unsupported; nonempty keywords fail
Latest version and declared metadata	Official Registry JSON	Official PyPI JSON
Weekly downloads	Official NPM download API	Optional PyPI Stats; otherwise null
Comparable weekly growth	Two adjacent complete seven-day windows	Same, if PyPI Stats supplies the daily data
Download/growth filters	Applied to available stats	Requires explicit pypistats mode
Missing requested filter value	Explicit run error	Explicit run error
Author as verified maintainer	Never	Never

The Actor does not download, install or execute any analyzed package, wheel, sdist, tarball, repository or install script. It reads JSON metadata only. It does not probe public contact addresses.

Inputs

• ecosystem: npm or pypi. Run them separately; mixed ecosystem input is rejected.
• keywords: NPM-only array of up to five search strings, each 3–100 characters. Joined with spaces using the official registry search syntax. Up to 300 candidates are considered, in source relevance order; no exhaustive-search guarantee.
• packageNames: up to 100 names, processed first. PyPI normalization collapses runs of hyphens, underscores and dots and ignores case. Explicit NPM names are lowercased and scoped names are supported.
• minWeeklyDownloads: optional inclusive threshold, at least zero.
• minGrowthPercent: optional inclusive percentage; negative values allowed. Omitting it means no growth filtering, rather than a zero-growth threshold.
• maxResults: 1–100 successful unique rows, default 5. PyPI Stats mode permits at most 10.
• maxCostUsd: additional package event budget, default $0.10 and maximum $0.50. Rounded down to whole $0.005 rows; zero performs no package work. Apify's per-run maximum total charge also applies.
• pypiStatsSource: none by default, or explicitly pypistats. NPM requires none.

Unknown inputs, invalid names/types and unsupported filter combinations raise descriptive errors. Filters are never silently dropped. When a requested numeric filter cannot be evaluated because a package's statistics are unavailable, the run fails explicitly; earlier successfully saved rows remain available and billable.

Output and provenance

Each row contains package_name, ecosystem, latest_version, maintainer_names, maintainer_emails, homepage_url, repository_url, license, weekly_downloads, previous_weekly_downloads, growth_percent, both periods' inclusive start/end dates, statistics_source, statistics_status, statistics_fetched_at, maintainer_source, maintainer_verified, author_name, source_url and fetched_at.

NPM maintainer fields come only from the official latest-release JSON maintainer list. These are release declarations and may not reflect current registry access rights. Using the bounded latest-release endpoint avoids downloading complete multi-version metadata histories. PyPI maintainer fields come only from release metadata's maintainer and maintainer_email fields, which can be stale or absent. Author fields are kept separately and never promoted into maintainers. Empty contact arrays mean the selected source field contains no usable public value. Emails are parsed only from explicit public maintainer contact fields; no inferred addresses, author-email fallback, profile scraping or enrichment.

maintainer_verified is always false: these are source declarations, not verification of current project authority, personal identity, inbox deliverability or consent to contact. A project is not classified as a commercial company, customer, revenue-generating business or sales lead.

Package license values describe the package's declared licensing and may be incomplete or stale. They do not license the registry API or metadata service. Read source service terms separately.

Download counts and growth

NPM uses https://api.npmjs.org/downloads/range/last-month/{package}. The official API supplies daily counts. We choose the latest available completed UTC day and require all seven daily values for weekly downloads and all fourteen for growth. Source data more than four days behind returns null statistics. Dates in the output identify the exact inclusive windows:

growth_percent = (current_weekly_downloads - previous_weekly_downloads) / previous_weekly_downloads * 100

A zero previous count produces null growth, never infinity or an invented percentage. A missing day is not interpreted as zero. Missing statistics remain null, not zero. A current complete week can be available while the previous week or growth is null. We make no “fast-growing” claim unless two complete comparable periods support the reported growth. Download counts are not unique users, revenue, installations in use or commercial adoption. Counts and mirror conventions differ between ecosystems; do not treat them as directly equivalent.

PyPI JSON's deprecated downloads fields are always -1 and are not used. Optional PyPI Stats uses https://pypistats.org/api/packages/{package}/overall?mirrors=false, retaining only without_mirrors daily rows. This is an independent third-party service using PyPI download data, not the official metadata API. It updates daily and has application-wide IP rate limits without a published fixed numeric allowance on its API page. The Actor uses a dedicated persistent daily cache and at most ten packages per run. Shared-IP limits, delays or outages can produce null statistics and explicit warnings. Repeated runs on the same UTC day reuse cached successful responses.

The official scalable alternative is bigquery-public-data.pypi.file_downloads. This Actor does not query BigQuery. Direct BigQuery integration would require an authorized Google Cloud project/credentials and can incur billed query costs beyond free allowances. No Google account or BigQuery charges are needed for this Actor.

Operational limits

Serial metadata requests use at least 1.05 seconds between starts, at most three attempts for safe GET/PUT operations, 15-second per-request timeouts, bounded exponential backoff and Retry-After handling. Responses are limited to 32 MiB; large metadata fails explicitly. One run has a 210-second HTTP deadline, stops starting package work after 195 seconds, and caps HTTP attempts at 500. Platform timeout is 240 seconds. Large or heavily filtered searches may return fewer than maxResults; maxResults is a ceiling.

Only fixed HTTPS metadata hosts are allowed. Redirects and package artifact requests are refused. Repository and homepage URLs are returned as metadata and are never visited. Dataset writes are not blindly retried after uncertain network failures; restart reconciliation reads existing ecosystem/name keys to prevent duplicate rows and billing.

SUMMARY in the key-value store records missing packages, statistics warnings, filtered counts, output count, elapsed time and request count. Failed lookups never become billable Dataset error rows. If every metadata lookup fails, the run fails.

Clay, n8n and exports

Use the Output links or Dataset Export button to obtain JSON and CSV:

• https://api.apify.com/v2/datasets/DATASET_ID/items?format=json&clean=true
• https://api.apify.com/v2/datasets/DATASET_ID/items?format=csv&clean=true

In n8n, run this Actor, wait for completion, then fetch the run's default Dataset. In Clay, import the CSV or retrieve Dataset JSON with your existing authorized Apify connection. Keep API tokens secret. Arrays remain arrays in JSON; CSV exports use Apify's native array serialization.

Source documentation and service terms

Reviewed 2026-11-02:

• NPM Registry API and download API specification.
• NPM Open Source Terms and crawler policy. Registry API 429 responses are respected; no universal fixed numeric registry allowance is assumed.
• PyPI JSON API, API policies and disabled XML-RPC search.
• PyPI Terms of Service. PyPI APIs prohibit spam-oriented data collection and selling users' personal information. Use this tool for technical package research, inventories and project maintenance. Do not use exports for spam, personal-information resale or contact-list marketing.
• PyPI Stats API and etiquette: cache daily, avoid bulk database collection.
• Official PyPI BigQuery datasets and download analysis guide.
• Apify pay-per-event documentation: one automatic default Dataset item event per saved unique package, $0.005. No separate synthetic start event.

Source availability and terms can change. This Actor is independent of npm, PyPI, PSF and PyPI Stats and does not imply their endorsement.