npm Package Release & Deprecation Monitor

Monitor explicit npm packages for changes to their latest version and latest-version deprecation status. It is built for engineering teams, package maintainers, dependency-watch workflows, and CI/agent automations that need a small, structured change feed rather than a full npm metadata crawl.

Unofficial tool. This Actor is not affiliated with, endorsed by, or sponsored by npm, Inc. It uses only the public npm registry endpoints described below.

What it checks

For every explicit package name, the Actor reads only these fixed public registry endpoints:

• https://registry.npmjs.org/-/package/<package>/dist-tags
• https://registry.npmjs.org/<package>/latest

It reports whether the package is available, its latest version, whether that version is deprecated, and a bounded deprecation reason when supplied. It does not fetch or emit complete package metadata, maintainers, authors, email addresses, download figures, tarballs, assets, or package version history.

Good use cases

• Monitor important production dependencies for new latest releases.
• Detect when the currently tagged latest version becomes deprecated.
• Feed bounded package-change events into a CI, Slack, ticket, or agent workflow.
• Maintain a lightweight watch list of up to 25 explicitly named packages.

Input

Field	Required	Description
packageNames	Yes	One to 25 explicit npm package names. URLs, paths, registry hosts, and arbitrary source expressions are rejected.
maxPackages	No	Maximum distinct packages processed, from 1 to 25. Default: 10.
includeUnchanged	No	Set to true to include unchanged snapshots. Default: false; unchanged checks are omitted after a baseline exists.
baselineKey	No	Namespace for durable package snapshots. Use a stable value for repeated monitoring.

Example input

{
  "packageNames": ["react", "typescript", "@types/node"],
  "maxPackages": 3,
  "includeUnchanged": false,
  "baselineKey": "production-dependencies"
}

Output

The default dataset contains only changed package snapshots (unless includeUnchanged is enabled) plus structured per-package errors. Key fields include:

Field	Meaning
packageName	Normalized npm package identifier.
latestVersion	Version currently tagged as latest.
latestDeprecated	Whether the latest version declares itself deprecated.
latestDeprecationReason	Bounded reason when the public registry supplies one.
changed / changeTypes	Whether availability, latest version, or latest deprecation changed versus the stored baseline.
snapshotHash	Stable hash for automation and deduplication.
warnings	Structured, target-level source or validation warnings.

Current price

$0.002 per checked package (checked-package).

A package check is charged before its two bounded registry requests, including checks that are unchanged and therefore omitted from the default dataset. This keeps pricing aligned with actual work. The Actor enforces Apify's configured charge limit; at the maximum input of 25 packages, the expected customer charge is capped at $0.05.

Recommended workflow

1. Start with a small, stable dependency list and a unique baselineKey.
2. Run once to create the baseline.
3. Schedule recurring runs with includeUnchanged: false.
4. Send only changed: true dataset items into your preferred alerting or automation destination.

Limits and data handling

• Maximum 25 unique package names per run.
• Fixed npm registry hosts and paths only; no arbitrary URLs or credentials.
• Each source request is bounded to 8 seconds, 256 KiB, and two redirects.
• The Actor retains only normalized snapshots needed for change detection in a named key-value store; baseline record keys are hashed.
• Registry availability and rate limits can affect a run. Source failures are returned as structured warnings for the affected package without failing the whole watch list.

Support

For reproducible issues, include the non-sensitive input shape, run ID, timestamp, and returned warning code. Do not include credentials or private dependency data in public reports.