Package Publisher Data — npm, PyPI & Docker Hub

Whether a company publishes SDKs on npm, PyPI or Docker Hub — and how recently — is a precise read on whether it has a real developer-facing product. This actor checks all three registries for one organization name and returns what it finds, with versions, licences, npm download and dependent counts, package status and last-publish dates.

No API key · Official source · Pay only for delivered rows · Same schema across the series

What data do you get?

Field	Description
companyName	Organization the package belongs to
status	active, or inactive when the registry marks the package deprecated, yanked, inactive or archived
statusRaw	The registry's own wording: PyPI development status (5 - Production/Stable), yanked, deprecated, or the Docker Hub repository status (archived)
registryName	npm, pypi or docker
packageName	Package or image name
version	Latest published version
description	Package description
licenseName	Declared licence (npm and PyPI; Docker Hub has none)
downloadsLastMonth	npm downloads over the last month
dependentCount	npm packages that depend on this one
keywords	Package keywords
publishers	Maintainer or publisher names
website, websiteSource	The organization's website: the domain carrying its name that its package homepages point to most often — else, with a GitHub token, the website on its GitHub profile when it is such a domain
email, emailSource	Contact address: the latest publisher or first maintainer (npm), the maintainer or author (PyPI); else the email the organization's website publishes on its own domain; else the GitHub profile's public email
phone, phoneSource	The phone the organization's website states (tel: link or JSON-LD, homepage or contact page)
githubOrganization, githubName, githubUrl, githubLocation, githubEmail, githubVerified, githubPublicRepos, githubFollowers, githubCreatedAt	The organization's public GitHub profile — only when you give a githubToken. city and countryName come from its location when it reads as City, State or City, Country
maintainers	Every maintainer with a reachable address, as {name, email}
repositoryUrl	Source repository link where declared
homepage	Package homepage
pullCount	Docker Hub pull count, where applicable
starCount	Docker Hub star count, where applicable
lastPublishedAt	Most recent publish or update
sourceUrl	Package page on the registry

Every row also carries query (what you asked for), scrapedAt (ISO timestamp) and, when a lookup fails, error explaining why.

Not applicable to a package. The company-register fields shared across this series (registrationNumber, taxNumber, legalForm, incorporatedOn, dissolvedOn, address, postalCode, industry, industryCode, employees, capital, officers) stay null on every row; city and countryName are filled only from a GitHub profile.

Example output

A real row from the prefilled run (addresses masked here; the dataset carries them in full):

{
  "country": "GLOBAL",
  "registry": "npm / PyPI / Docker Hub",
  "companyName": "stripe",
  "status": "active",
  "registryName": "npm",
  "packageName": "stripe",
  "version": "22.6.2",
  "description": "Stripe API wrapper",
  "licenseName": "MIT",
  "downloadsLastMonth": 72377456,
  "dependentCount": 2672,
  "keywords": ["stripe", "payment processing", "credit cards", "api"],
  "publishers": ["GitHub Actions", "stripe-bindings"],
  "website": "https://stripe.com",
  "email": "d•••@stripe.com",
  "maintainers": [{ "name": "stripe-bindings", "email": "d•••@stripe.com" }],
  "repositoryUrl": "git+https://github.com/stripe/stripe-node.git",
  "homepage": "https://github.com/stripe/stripe-node",
  "lastPublishedAt": "2026-09-09",
  "sourceUrl": "https://www.npmjs.com/package/stripe"
}

Input

{
  "queries": ["stripe","hashicorp","vercel"],
  "maxResultsPerQuery": 30,
  "maxConcurrency": 3,
  "includeRaw": false
}

Input	What it does
queries	Organization or npm scope names (stripe, hashicorp, google). Registries are checked in parallel for each name.
maxResultsPerQuery	Caps how many rows one query may produce.
maxConcurrency	How many queries run at once. Lower it if the source starts throttling.
includeRaw	Attaches the source's untouched record under raw, for fields this actor does not map.
requestDelayMs	Politeness delay between requests.
proxyConfiguration	Optional. All three registries answer datacenter IPs directly.
githubToken	Optional. A GitHub personal access token (no scopes needed; only public data is read). With it, the GitHub organization the packages' repositories point to adds its profile fields. Without it, GitHub is not called. Stored encrypted and sent only to api.github.com.

What people use it for

• Developer-product qualification — a company with maintained SDKs on all three registries has a real API product; one with none does not.
• Technographic enrichment — package languages and dependencies say what a company builds with.
• Ecosystem mapping — find every package published under an organization scope, with licences.

Notes and limits

• npm is searched by scope and by maintainer, so both @stripe/... packages and unscoped ones the organization maintains come back.
• PyPI has no organization index, so the actor probes the obvious project names and then verifies provenance: a project is only attributed to the company when the company owns something on it — an address at its domain, a homepage on its domain, a repository under its account, or its name as author. That avoids crediting an unrelated project that happens to share the name (Hive Solutions' stripe-api is not Stripe's).
• Maintainer addresses are personal data. npm shows them on every package page and PyPI in each project's metadata; this actor returns them as published, skipping bot and no-reply addresses. If you store or contact them, data-protection and anti-spam rules (GDPR, CAN-SPAM) apply to you.
• Package status comes from each registry's own signal: npm's search leaves deprecated packages out altogether (so npm rows are live packages), PyPI's from the Development Status classifier and yanked releases, Docker Hub's from the repository status.

Where the data comes from

npm, PyPI and Docker Hub all serve public package metadata through documented APIs with no key. Source: npm registry, PyPI JSON API and Docker Hub API

FAQ

Is this package registry publisher scraper free?

The data source is free and needs no API key — you pay only for the rows the run delivers ($0.002 each). Failed or empty lookups are never charged.

Do I need an API key or a login?

No. npm, PyPI and Docker Hub all serve public package metadata through documented APIs with no key.

What can I search by?

By organization or scope name (stripe, google, hashicorp). All three registries are checked for each query.

How current is the data?

Every run queries the source live, so results are as fresh as the source itself. All three registries answer live.

How fast is it, and how many queries can I run?

Queries run concurrently (3 at a time by default, tunable in the input). A prefilled run finishes in seconds; large lists scale roughly linearly and stay well inside a normal run timeout.

Can I export the results to CSV, Excel or JSON?

Yes. Apify datasets export to CSV, Excel, JSON, XML and HTML, and can be pulled through the API or pushed to your own storage.

What happens when a query returns nothing?

You still get a row, carrying your original query and an error field explaining why. Nothing is silently dropped, and you are not charged for it.

Is scraping this data legal?

Yes. Public package metadata is published by each registry precisely so it can be indexed and reused.

Changelog

0.1.11 — 2026-09-25 — website contacts, optional GitHub profile

• phone and a fallback email from the organization's website: only mailto:/tel: links and schema.org JSON-LD on the homepage or its contact page, an email only on the organization's own domain; package maintainers' addresses still come first. New emailSource, phoneSource, websiteSource.
• Optional githubToken input. With a token, the GitHub organization the packages' repositories point to (never a guess from the name, never a personal account) adds githubOrganization, githubName, githubUrl, githubLocation, githubEmail, githubVerified, githubPublicRepos, githubFollowers, githubCreatedAt, city/countryName when its location is a clear City, State/Country, and a website when the packages give none. Without a token nothing changes and GitHub is not called.
• No pricing change.

0.1.10 — 2026-09-25 — organization website

• website is filled with the organization's own site: the domain carrying its name that its package homepages point to most often (stripe → https://stripe.com, vercel → https://vercel.com), on every row of the query. Homepages on GitHub, a registry or a product domain give none — hashicorp's packages point to GitHub, so its rows stay empty. 0% → 67% in the prefilled run.
• No pricing change.

0.1.9 — 2026-09-25 — maintainer contacts; stricter PyPI attribution

• New: email and maintainers. npm lists every maintainer with the address shown on the package page, and PyPI carries author and maintainer addresses; both are now returned (maintainers: {name, email} for each, email: the first). Bot and no-reply addresses — npm's trusted-publishing bot, GitHub's noreply relay — are skipped. In the prefilled run 74% of rows carry an address (every npm and PyPI row; Docker Hub publishes none).
• PyPI attribution is stricter. A project is credited to an organization only when the organization owns something on it — an address at its domain, a homepage on its domain, a repository under its account, or its name as author. Mentioning the name was enough before, which credited Hive Solutions' stripe-api to Stripe.
• No pricing change.

0.1.8 — 2026-09-25 — licence, status and npm popularity filled

• licenseName is filled for npm and PyPI (1% of rows before, 72% in the prefilled run; Docker Hub publishes no licence). npm's search result carries the licence; PyPI's is read from license_expression, a short license, or the License :: classifier, where stripe declares it.
• status means something now. It was unknown on every row; it is inactive when the registry marks a package deprecated, yanked, inactive or archived (Docker Hub stripe/veneur: archived), with the registry's own wording in statusRaw.
• New npm fields downloadsLastMonth and dependentCount, from the same search response — no extra requests.
• The company-register fields that cannot apply to a package are labelled as such in the dataset schema.
• README example replaced with a real row. No pricing change.

---

Built by Fox Labs — B2B company intelligence from public sources, as clean JSON.