Dev Ecosystem Report | npm, PyPI, crates.io, GitHub and OSV

Get an agent-ready package health report for any npm, PyPI, or crates.io package, or any public GitHub repository, in a single JSON row. Each report combines registry metadata, download counts, maintainers, GitHub repository health, and known vulnerabilities from the OSV.dev database, plus a simple healthy / caution / risky verdict with human-readable reasons.

Use it for dependency due diligence, supply-chain reviews, open-source vendor vetting, and as a tool call for AI coding agents that must decide whether a library is safe and maintained before adding it to a project.

What each report contains

• Registry data: latest version, package description (package_description), license, homepage, repository URL, maintainers, first and last publish dates, version count, deprecated or yanked flag.
• Downloads: last day, last week, and last month for npm and PyPI; recent and total downloads for crates.io.
• GitHub repo health: stars, forks, open issues, language, license, archived flag, last push date, days since last push, latest release tag, and topics.
• Vulnerabilities: every OSV advisory affecting the latest published version, with ID, aliases (CVE), summary, severity, fixed-in versions, and a link.
• Health verdict: level plus reasons, for example "single maintainer (bus factor 1)", "GitHub repository is archived", or "known high severity vulnerabilities".

Input

{
  "packages": [
    { "ecosystem": "npm", "name": "express" },
    { "ecosystem": "pypi", "name": "requests" },
    { "ecosystem": "crates", "name": "serde" }
  ],
  "githubRepos": ["apify/crawlee"],
  "includeVulnerabilities": true,
  "includeGithubHealth": true
}

Field	Description
packages	List of { ecosystem, name }. Ecosystems: npm, pypi, crates. Scoped npm names are supported.
githubRepos	Standalone repos as owner/repo or a github.com URL.
includeVulnerabilities	Query OSV.dev. Default on.
includeGithubHealth	Fetch GitHub stats for each package's repository. Default on.
githubToken	Optional token to raise the GitHub limit from 60 to 5,000 requests per hour.
concurrency	Parallel packages, 1 to 10.

Pricing

Pay-per-event pricing:

• Actor start: $0.02 once per run.
• Package report: $0.005 per package or repository report generated.

Cost examples: 10 packages cost $0.02 + 10 × $0.005 = $0.07. 100 packages cost $0.52. 1,000 packages cost $5.02, or about $5 per 1,000 reports. Packages that do not exist and other failed lookups are returned with an error field and are not charged.

Data sources

All data comes from public, documented APIs: the npm registry and download API, the PyPI JSON API and pypistats.org, the crates.io API, the GitHub REST API, and OSV.dev. No scraping and no logins.

Tips

• For large batches, pass a githubToken so GitHub health lookups are not rate limited. Without it, repo health is skipped gracefully once the limit is hit and the rest of the report is still returned.
• PyPI download counts come from pypistats.org, which may rate-limit bursts; counts are returned as null when unavailable.
• Vulnerabilities are matched against the latest version of each package. Use the fixed_in field to see which versions patch each advisory.

Use with AI agents

Output is a flat, typed JSON object per package, designed to be consumed by LLM tool calls through the Apify API or the MCP server for Apify Actors. Branch on health.level or vulnerability_count to approve or block a dependency automatically.