npm Package Scraper — Downloads, Versions & Dependencies | $1/1K No Auth

Used by DevSecOps teams auditing dependency versions, developer tooling companies mapping the npm ecosystem, and AI agents that need package metadata mid-conversation.

Scrape npm package metadata, download statistics, and search results via the official npm Registry JSON API. No proxy, no authentication, no HTML parsing. The registry exposes structured JSON endpoints that return the complete package graph.

What you get per package

Field	Example
package_name	react
version_latest	19.2.6
description	React is a JavaScript library for building user interfaces.
author	react-bot
license	MIT
homepage	https://react.dev/
repository_url	https://github.com/facebook/react.git
keywords	react
dependencies_count	0
downloads_last_month	558972112
modified	2026-05-29T18:04:30.838Z
created	2011-10-26T17:46:21.942Z
parse_confidence	1.0
warnings	[]

Two modes

1. Package lookup (packageNames) Direct registry fetch for exact package names. Returns full metadata including dependency count. Supports scoped packages (@types/node).

2. Search (searchQueries) Keyword search across the npm registry. Returns top matching packages with embedded download stats. No extra API calls needed for downloads in search mode.

Why this actor beats HTML-scrapers

The official registry.npmjs.org JSON API is:

• Stable — documented, versioned, used by npm CLI itself since 2011
• Fast — no JavaScript rendering, direct JSON
• Zero-cost — no proxy needed, no auth
• Honest — parse_confidence=1.0 on every real package (JSON fields, not fragile selectors)

HTML scrapers of npmjs.com break on every layout change. This actor will never silently return empty results — the parse_confidence field tells you immediately if something is wrong.

Input

{
  "packageNames": ["react", "express", "@types/node"],
  "searchQueries": ["http client", "date formatting"],
  "maxItems": 100,
  "includeDownloads": true
}

Field	Type	Default	Description
packageNames	list	[]	Package names to look up directly
searchQueries	list	[]	Search keywords
maxItems	int	50	Max total results (0 = unlimited)
includeDownloads	bool	true	Fetch last-month download stats
searchSize	int	20	Results per search query (max 250)

Pricing examples

Run	Items	Cost
10 packages (direct lookup)	10	~$0.01
100 packages	100	~$0.10
1,000 packages	1,000	~$1.00
Search "http client" — top 50 results	50	~$0.05

You only pay for package records pushed. No surcharge for download stats or search runs.

FAQ

Do I need an API key or proxy? No. The npm Registry and downloads API are fully public. Zero proxy cost for buyers.

What is the difference between packageNames and searchQueries? packageNames fetches exact package metadata by name (e.g. react, @types/node) — fastest, most complete data. searchQueries performs keyword discovery (e.g. "http client") and returns top-matching packages — useful for market research.

Can I monitor a list of packages for version changes? Yes. Schedule daily runs on your package list and compare version_latest between runs. Cheaper than Dependabot for large custom lists and requires no repo access.

What if a package isn't found? The actor logs a warning, skips it, and continues. Missing packages appear in the OUTPUT key-value store under failedDetails.

Pricing

Pricing: $1.00 per 1,000 packages. No compute surcharge for search runs.

Why this actor beats HTML-scrapers (named comparison)

	This actor	Any HTML npm scraper	npmjs.com UI
API stability	Official registry API since 2011	Breaks on layout change	Manual
Batch input	Yes (any list size)	No	No
Download stats	Yes (last month)	No	No
Scoped packages	Yes (@types/node)	Sometimes	Manual
parse_confidence	Yes	No	—

Version monitoring

Scheduled runs on a list of packages alert you when version_latest changes — dependency update automation without Dependabot. Run daily, pay only for what changes.

Use cases

• Competitor package research (who has more downloads, what license)
• Dependency audit across a list of package names
• Building npm package databases or dashboards
• Monitoring a set of packages for version changes
• Search-based discovery of packages for a topic

Notes

• Not affiliated with npm, Inc. or GitHub. Uses only public APIs with no rate-limit tricks.
• Download stats from api.npmjs.org cover the previous calendar month. For search mode, weekly+monthly stats are embedded in the search result — no extra API call.
• Scoped packages (e.g. @types/node) are supported.
• The parse_confidence field is always 1.0 for a valid JSON API response. A sub-1.0 score means a field was missing from the API response — check warnings for the reason.

Use with AI agents (MCP)

This actor is callable as a tool by AI agents (Claude Desktop, Cursor, VS Code, n8n, LangGraph, CrewAI, or any MCP-compatible client) via Apify's hosted Model Context Protocol server. An agent uses it to look up npm package metadata, version history, download counts, and dependency info mid-conversation — e.g. "what version of lodash is current and how many weekly downloads does it have?" or "compare the license and dep count of axios vs node-fetch".

Point your MCP client at this single tool:

{
  "mcpServers": {
    "apify": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://mcp.apify.com/?tools=bovi/npm-registry-scraper",
        "--header",
        "Authorization: Bearer <YOUR_APIFY_TOKEN>"
      ]
    }
  }
}

Minimal call an agent can make:

{ "packageNames": ["react", "lodash"] }

Example output row the agent receives (flat, agent-friendly):

{ "package_name": "react", "version_latest": "19.2.6", "description": "React is a JavaScript library for building user interfaces.",
  "author": "react-bot", "license": "MIT", "downloads_last_month": 558972112,
  "dependencies_count": 0, "keywords": "react", "homepage": "https://react.dev/",
  "repository_url": "https://github.com/facebook/react.git",
  "modified": "2026-05-29T18:04:30.838Z", "parse_confidence": 1.0, "warnings": [] }

Reliability for agents: data comes from the official registry.npmjs.org JSON API — the same source the npm CLI uses since 2011. No HTML scraping, no proxy needed. parse_confidence reflects whether any expected fields were absent from the API response (1.0 = fully populated). No API key needed inside the tool — auth is your Apify token in the client config above.

Integrations

Built for DevSecOps and developer-tooling teams auditing package versions, downloads, and dependency graphs — the JSON/dataset output drops into the tools you already run, no glue code:

• n8n / Make / Zapier — trigger a run or pipe every new dataset item into 500+ apps (Google Sheets, Airtable, Slack, HubSpot, your database) with no code: n8n, Make, Zapier.
• Webhooks — fire your own endpoint the moment a run finishes, to push results straight into your pipeline (docs).
• MCP server — expose this actor as a tool to Claude, Cursor, or any MCP client so an AI agent can pull this data mid-conversation (guide).
• API & SDKs — fetch the dataset as JSON, CSV, or Excel through the Apify REST API or the Python / JS SDKs.

See all Apify integrations.