npm Package Scraper — Downloads, Versions & Dependencies | $1/1K No Auth

Used by DevSecOps teams auditing dependency versions, developer tooling companies mapping the npm ecosystem, and AI agents that need package metadata mid-conversation.

Scrape npm package metadata, download statistics, and search results via the official npm Registry JSON API. No proxy, no authentication, no HTML parsing. The registry exposes structured JSON endpoints that return the complete package graph.

What you get per package

Field	Example
package_name	react
version_latest	19.2.6
description	React is a JavaScript library for building user interfaces.
author	react-bot
license	MIT
homepage	https://react.dev/
repository_url	https://github.com/facebook/react.git
keywords	react
dependencies_count	0
downloads_last_month	558972112
modified	2026-05-29T18:04:30.838Z
created	2011-10-26T17:46:21.942Z
parse_confidence	1.0
warnings	[]

Two modes

1. Package lookup (packageNames) Direct registry fetch for exact package names. Returns full metadata including dependency count. Supports scoped packages (@types/node).

2. Search (searchQueries) Keyword search across the npm registry. Returns top matching packages with embedded download stats. No extra API calls needed for downloads in search mode.

Why this actor beats HTML-scrapers

The official registry.npmjs.org JSON API is:

• Stable — documented, versioned, used by npm CLI itself since 2011
• Fast — no JavaScript rendering, direct JSON
• Zero-cost — no proxy needed, no auth
• Honest — parse_confidence=1.0 on every real package (JSON fields, not fragile selectors)

HTML scrapers of npmjs.com break on every layout change. This actor will never silently return empty results — the parse_confidence field tells you immediately if something is wrong.

Input

{
  "packageNames": ["react", "express", "@types/node"],
  "searchQueries": ["http client", "date formatting"],
  "maxItems": 100,
  "includeDownloads": true
}

Field	Type	Default	Description
packageNames	list	[]	Package names to look up directly
searchQueries	list	[]	Search keywords
maxItems	int	50	Max total results (0 = unlimited)
includeDownloads	bool	true	Fetch last-month download stats
searchSize	int	20	Results per search query (max 250)

Pricing examples

Run	Items	Cost
10 packages (direct lookup)	10	~$0.01
100 packages	100	~$0.10
1,000 packages	1,000	~$1.00
Search "http client" — top 50 results	50	~$0.05

You only pay for package records pushed. No surcharge for download stats or search runs.

FAQ

Do I need an API key or proxy? No. The npm Registry and downloads API are fully public. Zero proxy cost for buyers.

What is the difference between packageNames and searchQueries? packageNames fetches exact package metadata by name (e.g. react, @types/node) — fastest, most complete data. searchQueries performs keyword discovery (e.g. "http client") and returns top-matching packages — useful for market research.

Can I monitor a list of packages for version changes? Yes. Schedule daily runs on your package list and compare version_latest between runs. Cheaper than Dependabot for large custom lists and requires no repo access.

What if a package isn't found? The actor logs a warning, skips it, and continues. Missing packages appear in the OUTPUT key-value store under failedDetails.

Pricing

Pricing: $1.00 per 1,000 packages. No compute surcharge for search runs.

Why this actor beats HTML-scrapers (named comparison)

	This actor	Any HTML npm scraper	npmjs.com UI
API stability	Official registry API since 2011	Breaks on layout change	Manual
Batch input	Yes (any list size)	No	No
Download stats	Yes (last month)	No	No
Scoped packages	Yes (@types/node)	Sometimes	Manual
parse_confidence	Yes	No	—

Version monitoring

Scheduled runs on a list of packages alert you when version_latest changes — dependency update automation without Dependabot. Run daily, pay only for what changes.

Use cases

• Competitor package research (who has more downloads, what license)
• Dependency audit across a list of package names
• Building npm package databases or dashboards
• Monitoring a set of packages for version changes
• Search-based discovery of packages for a topic

Notes

• Not affiliated with npm, Inc. or GitHub. Uses only public APIs with no rate-limit tricks.
• Download stats from api.npmjs.org cover the previous calendar month. For search mode, weekly+monthly stats are embedded in the search result — no extra API call.
• Scoped packages (e.g. @types/node) are supported.
• The parse_confidence field is always 1.0 for a valid JSON API response. A sub-1.0 score means a field was missing from the API response — check warnings for the reason.

Use with AI agents (MCP)

This actor is callable as a tool by AI agents (Claude Desktop, Cursor, VS Code, n8n, LangGraph, CrewAI, or any MCP-compatible client) via Apify's hosted Model Context Protocol server. An agent uses it to look up npm package metadata, version history, download counts, and dependency info mid-conversation — e.g. "what version of lodash is current and how many weekly downloads does it have?" or "compare the license and dep count of axios vs node-fetch".

Point your MCP client at this single tool:

{
  "mcpServers": {
    "apify": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://mcp.apify.com/?tools=bovi/npm-registry-scraper",
        "--header",
        "Authorization: Bearer <YOUR_APIFY_TOKEN>"
      ]
    }
  }
}

Minimal call an agent can make:

{ "packageNames": ["react", "lodash"] }

Example output row the agent receives (flat, agent-friendly):

{ "package_name": "react", "version_latest": "19.2.6", "description": "React is a JavaScript library for building user interfaces.",
  "author": "react-bot", "license": "MIT", "downloads_last_month": 558972112,
  "dependencies_count": 0, "keywords": "react", "homepage": "https://react.dev/",
  "repository_url": "https://github.com/facebook/react.git",
  "modified": "2026-05-29T18:04:30.838Z", "parse_confidence": 1.0, "warnings": [] }

Reliability for agents: data comes from the official registry.npmjs.org JSON API — the same source the npm CLI uses since 2011. No HTML scraping, no proxy needed. parse_confidence reflects whether any expected fields were absent from the API response (1.0 = fully populated). No API key needed inside the tool — auth is your Apify token in the client config above.

Integrations

Built for DevSecOps and developer-tooling teams auditing package versions, downloads, and dependency graphs — the JSON/dataset output drops into the tools you already run, no glue code:

• n8n / Make / Zapier — trigger a run or pipe every new dataset item into 500+ apps (Google Sheets, Airtable, Slack, HubSpot, your database) with no code: n8n, Make, Zapier.
• Webhooks — fire your own endpoint the moment a run finishes, to push results straight into your pipeline (docs).
• MCP server — expose this actor as a tool to Claude, Cursor, or any MCP client so an AI agent can pull this data mid-conversation (guide).
• API & SDKs — fetch the dataset as JSON, CSV, or Excel through the Apify REST API or the Python / JS SDKs.

See all Apify integrations.

Usage statistics

This Actor creates a small, content-free summary at the end of each run. It is used only to monitor reliability and improve this Actor. A copy is saved as USAGE_STATS in your own Apify key-value store, so you can see the exact record created for your run.

Set disableUsageStats to true in the input to opt out. Nothing is sent then; your USAGE_STATS record only says that statistics were disabled.

Only these fields are recorded:

• schema version, Actor name and build number;
• UTC start and finish hour (not a precise timestamp);
• run duration, number of results and time to the first result, each as a coarse range;
• whether the result was empty, the end status, and an error type from a fixed list;
• memory setting and counts of charged events;
• names of the input fields you set, never their values;
• the selected option for input fields that offer a fixed list of choices (for example a sort order).

We do not collect input text, search terms, URLs, domains, usernames, email addresses, names, proxy credentials, tokens, scraped records, output items, raw error messages, stack traces, or hashes of any of those values. Records are kept for no longer than 13 months, used only as aggregated operational statistics, and never sold or shared.

Additional fields (Phase 2)

This Actor also records your Apify user ID, whether Apify marks the account as paying, the size range of list inputs, the selected country when the input offers a fixed list of countries, and one category from a fixed Actor taxonomy. We use these fields only for aggregate reliability, repeat-use and cross-Actor analysis; reports suppress any cell with fewer than five distinct users.

The same disableUsageStats: true input flag turns these fields off too. The user ID is removed after 13 months; we do not export, sell, share, or attempt to re-identify this data.

Run-outcome signals (v2)

To learn whether a run did what it was asked to do, the record also holds a few more coarse ranges and yes/no flags. None of them contains content:

• the result limit you asked for (a range, when the input has one) and what share of it was delivered;
• results delivered per input item you listed (a range);
• output quality as ranges: how fully the result fields were filled, the share of rows that look like errors, the share of duplicate rows, and how many different fields appeared. These are counted in memory while results are saved; no result content is kept;
• how the run was started (console, API, schedule, webhook, another Actor);
• how it ended: stopped by you, timed out, reached the requested limit, stopped by the charge limit, and how many times the platform moved the run;
• if this Actor reports it: how many items to process worked or failed (ranges) and one failure reason from a fixed list;
• a short code made from the names of the input fields you set, never their values.

Repeat-run fingerprint (v2)

When your Apify user ID is recorded (see above), the record also holds an 8-character one-way code made from your input (proxy settings left out) and this Actor's name. It only lets us see that the same account ran the same input again soon after an unsatisfying run; we never see the input itself. It is stored only in the database, never published, and reports use it in aggregate with the same five-user minimum. It is the one exception to the statement above that no hashes are collected, and disableUsageStats: true turns it off.