Package Registry Scraper: npm, PyPI & Docker Hub

Paste a dependency list. Get back one table telling you what each package is, who maintains it, when it last shipped, and whether it has gone quiet.

{
  "packages": ["express", "lodash", "pypi:requests", "pypi:django", "docker:nginx"],
  "staleAfterDays": 365
}

Why one Actor instead of three

Every other package Actor in the Store wraps a single registry and hands back whatever JSON that registry happens to emit. That does not match the job people actually have. A real project's dependencies span npm and PyPI and a base image, and each registry names the same idea differently: dist-tags.latest vs info.version vs a tag list; time.created vs a file upload timestamp vs date_registered.

Here every row has the same keys no matter where it came from, so you can sort the whole audit by daysSinceRelease in one pass.

Do you need an API key? No. Is there a free tier? Yes.

The two things people search for in this category, measured, are free and API key: npm package api, npm package search api.

So, plainly:

• No API key. Nothing to register for, nothing to rotate, no key to leak in a repo. The source is a public API published deliberately by its owner.
• No proxy setup. The source does not bot-wall datacenter addresses, so the default works.
• Pay per result, not per month. There is no subscription and no minimum. Rows that error or that your filters drop are not charged.
• Free to try. Run it with the prefilled input and see real rows before deciding anything.

What you get per package

Field
registry	npm, pypi or docker
name, version	latest published version
license, author, homepage, repository	provenance
lastRelease, firstRelease, daysSinceRelease	the staleness signal
isStale	true when daysSinceRelease ≥ your threshold
deprecated	npm's deprecation flag, PyPI's Inactive classifier, Docker's inactive status
versionCount	how many releases exist
dependencies	direct dependency names
downloadsLastWeek	npm
pulls, stars, recentTags, isOfficial	Docker Hub
knownVulnerabilities, requiresPython	PyPI

One honest gap

PyPI download counts are null, not estimated. PyPI removed download statistics from its API in 2016; the numbers live in a public BigQuery dataset now. Third-party mirrors exist and other Actors quietly present their numbers as if they came from PyPI. A figure whose provenance you cannot check is worse than an empty field, so this returns null and says why.

npm download counts are real, they come from npm's own downloads API. Docker Hub reports lifetime pulls.

Use cases

• Dependency audit: sort by daysSinceRelease, find what nobody is maintaining
• License compliance: one column across all three registries
• Supply-chain review: deprecated, knownVulnerabilities, versionCount, contributor-free packages
• Vendor diligence: is the library behind this product still alive
• Base-image hygiene: docker: rows show pull counts and recent tags

Pricing

Charged per package returned. A name that does not exist in the registry produces an error row and costs $0.00.

Three registries, one row shape

Registry	Prefix	Source
npm	npm:express or bare express	the npm registry, plus api.npmjs.org for download counts
PyPI	pypi:requests	the PyPI JSON API
Docker Hub	docker:nginx	the Docker Hub v2 repositories API

Mix them in one list and every row comes back with the same field names, so an npm package and a PyPI package line up column for column. registry on each row says where it came from.

Per package: name, version, description, license, homepage and repository URLs, author, keywords, direct dependencies, publish date, last-updated date, and download or pull counts where the registry publishes them.

Supply-chain and dependency-audit use. staleAfterDays flags anything not updated inside your window, which is the question behind most package audits: what are we depending on that nobody maintains any more. Licence and repository URL come back on the same row, so a licence review and a staleness review are one export rather than three.

No key, no login, on any of the three. All are the registries' own public metadata endpoints, the same ones npm view and pip show read.

Notes

• Docker names without a slash are resolved to the official library/ namespace, so docker:nginx and docker:library/nginx are the same thing.
• dependencies lists direct dependencies only. Transitive resolution is a different job and would mean guessing at version ranges.
• Up to 500 packages per run.

FAQ

Which registries are supported?

npm, PyPI and Docker Hub, in one run. Prefix a name to pick the registry, as in pypi:requests or docker:nginx, and a bare name is treated as npm.

Do I need an API key for any of them?

No. All three are read through their official public registry APIs, with no key and no login.

Why use this instead of three separate Actors?

Because a real project's dependencies span all three, and each registry names the same idea differently: dist-tags.latest vs info.version vs a tag list, time.created vs an upload timestamp vs date_registered. Every row here has the same keys regardless of origin, so you can sort a whole audit by daysSinceRelease in one pass.

How do I find unmaintained dependencies?

Sort by daysSinceRelease, or set staleAfterDays and filter on isStale. Also check deprecated, which maps npm's deprecation flag, PyPI's Inactive classifier and Docker's inactive status onto one field.

Why are PyPI download counts null?

Because PyPI removed download statistics from its API in 2016. The numbers now live in a public BigQuery dataset. Third-party mirrors exist and some tools present their figures as if they came from PyPI. A number whose provenance you cannot check is worse than an empty field, so this returns null and says why. npm download counts are real, from npm's own downloads API.

Does it resolve transitive dependencies?

No. dependencies lists direct dependencies only. Resolving the full tree means guessing at version ranges, which is a different job and a different kind of answer.

How many packages can I check in one run?

Up to 500.

Is docker:nginx the same as docker:library/nginx?

Yes. Docker names without a slash are resolved to the official library/ namespace.