Package Metadata: npm and PyPI versions, licenses, dependencies

Give it a list of npm packages and PyPI projects and get one clean row per package from the official registries: what the latest version is, its license, when it was published, what it depends on, and how it has been released over time. Useful for license audits, dependency reviews, release tracking and ecosystem research.

For each package you get:

• Latest version, description, license, homepage, repository link and keywords
• First release date, last publish date and number of versions
• Versions with their release dates, newest first (npm deprecation notes and PyPI yanked flags included)
• Dependencies of the latest version: npm runtime, peer and optional dependencies, the number of dev dependencies and supported engines; PyPI required packages, optional extras and the supported Python versions
• npm: dist tags, deprecation notice, module type, whether types ship with the package, unpacked size, and downloads for the last week and last month
• PyPI: classifiers, project links, yanked state, and the known vulnerabilities PyPI lists for the latest release, with their ids, aliases, and the versions that fix them

Input

• npm packages: names such as react, scoped names such as @types/node.
• PyPI projects: names such as requests or Django.
• Version history on or off (on by default), and how many of the newest versions to list (default 50).
• npm download counts on or off (on by default). PyPI publishes no download counts, so there are none for PyPI projects.

Output

One dataset item per package, with ecosystem, input, name, latestVersion, description, license, homepage, repository, keywords, created, lastPublished, versionCount, versions and dependencies, plus the npm or PyPI fields listed above. A name that is not valid for its registry, or a package the registry does not hold, gives an item with error. A package named twice is fetched once.

Maintainer, author and owner details are never collected. Only the package and project facts are kept.

Sources

• npm: the public registry at registry.npmjs.org and npm's download counts API at api.npmjs.org. npm's terms allow copying data from the public registry through its public APIs.
• PyPI: the JSON API for project details and vulnerabilities, and the Index API for versions and upload times, as PyPI's documentation recommends.

Requests go one at a time with a short gap. The actor is not affiliated with or endorsed by npm, GitHub or the Python Software Foundation.

Pricing

Pay per event: one package-fetched event per package returned. Errors are not charged. The run stops when it reaches the maximum charge you set.

Support

Questions and problems: the Issues tab on this page. Replies are written by an AI assistant on behalf of the developer and reviewed by the developer.