# Package Registry Scraper: npm, PyPI & Docker Hub (`glitchbound/packages-scraper`) Actor

Audit a dependency list across three registries in one run. Returns version, license, author, release history, last-release age, dependency list and a stale flag in one identical shape for npm, PyPI and Docker Hub. Official registry APIs, no key.

- **URL**: https://apify.com/glitchbound/packages-scraper.md
- **Developed by:** [Daniel Meshulam](https://apify.com/glitchbound) (community)
- **Categories:** Developer tools, Automation, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.75 / 1,000 packages

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Package Registry Scraper: npm, PyPI & Docker Hub

Paste a dependency list. Get back one table telling you what each package is,
who maintains it, when it last shipped, and whether it has gone quiet.

```json
{
  "packages": ["express", "lodash", "pypi:requests", "pypi:django", "docker:nginx"],
  "staleAfterDays": 365
}
```

### Why one Actor instead of three

Every other package Actor in the Store wraps a single registry and hands back
whatever JSON that registry happens to emit. That does not match the job people
actually have. A real project's dependencies span npm *and* PyPI *and* a base
image, and each registry names the same idea differently: `dist-tags.latest`
vs `info.version` vs a tag list; `time.created` vs a file upload timestamp vs
`date_registered`.

Here every row has the **same keys** no matter where it came from, so you can
sort the whole audit by `daysSinceRelease` in one pass.

### Do you need an API key? No. Is there a free tier? Yes.

The two things people search for in this category, measured, are **free** and
**API key**: `npm package api`, `npm package search api`.

So, plainly:

- **No API key.** Nothing to register for, nothing to rotate, no key to leak in
  a repo. The source is a public API published deliberately by its owner.
- **No proxy setup.** The source does not bot-wall datacenter addresses, so the
  default works.
- **Pay per result, not per month.** There is no subscription and no minimum.
  Rows that error or that your filters drop are **not charged**.
- **Free to try.** Run it with the prefilled input and see real rows before
  deciding anything.

### What you get per package

| Field | |
|---|---|
| `registry` | `npm`, `pypi` or `docker` |
| `name`, `version` | latest published version |
| `license`, `author`, `homepage`, `repository` | provenance |
| `lastRelease`, `firstRelease`, `daysSinceRelease` | the staleness signal |
| `isStale` | `true` when `daysSinceRelease` ≥ your threshold |
| `deprecated` | npm's deprecation flag, PyPI's *Inactive* classifier, Docker's inactive status |
| `versionCount` | how many releases exist |
| `dependencies` | direct dependency names |
| `downloadsLastWeek` | npm |
| `pulls`, `stars`, `recentTags`, `isOfficial` | Docker Hub |
| `knownVulnerabilities`, `requiresPython` | PyPI |

### One honest gap

**PyPI download counts are `null`, not estimated.** PyPI removed download
statistics from its API in 2016; the numbers live in a public BigQuery dataset
now. Third-party mirrors exist and other Actors quietly present their numbers as
if they came from PyPI. A figure whose provenance you cannot check is worse than
an empty field, so this returns `null` and says why.

npm download counts are real, they come from npm's own downloads API. Docker
Hub reports lifetime `pulls`.

### Use cases

- **Dependency audit**: sort by `daysSinceRelease`, find what nobody is maintaining
- **License compliance**: one column across all three registries
- **Supply-chain review**: `deprecated`, `knownVulnerabilities`, `versionCount`, contributor-free packages
- **Vendor diligence**: is the library behind this product still alive
- **Base-image hygiene**: `docker:` rows show pull counts and recent tags

### Pricing

Charged per package returned. A name that does not exist in the registry
produces an `error` row and costs **$0.00**.

### Three registries, one row shape

| Registry | Prefix | Source |
|---|---|---|
| **npm** | `npm:express` or bare `express` | the npm registry, plus `api.npmjs.org` for download counts |
| **PyPI** | `pypi:requests` | the PyPI JSON API |
| **Docker Hub** | `docker:nginx` | the Docker Hub v2 repositories API |

Mix them in one list and every row comes back with the same field names, so an
npm package and a PyPI package line up column for column. `registry` on each row
says where it came from.

**Per package**: name, version, description, license, homepage and repository
URLs, author, keywords, direct dependencies, publish date, last-updated date,
and download or pull counts where the registry publishes them.

**Supply-chain and dependency-audit use.** `staleAfterDays` flags anything not
updated inside your window, which is the question behind most package audits:
what are we depending on that nobody maintains any more. Licence and repository
URL come back on the same row, so a licence review and a staleness review are
one export rather than three.

**No key, no login, on any of the three.** All are the registries' own public
metadata endpoints, the same ones `npm view` and `pip show` read.

### Notes

- Docker names without a slash are resolved to the official `library/` namespace, so `docker:nginx` and `docker:library/nginx` are the same thing.
- `dependencies` lists direct dependencies only. Transitive resolution is a different job and would mean guessing at version ranges.
- Up to 500 packages per run.

### FAQ

#### Which registries are supported?

npm, PyPI and Docker Hub, in one run. Prefix a name to pick the registry,
as in `pypi:requests` or `docker:nginx`, and a bare name is treated as npm.

#### Do I need an API key for any of them?

No. All three are read through their official public registry APIs, with no key
and no login.

#### Why use this instead of three separate Actors?

Because a real project's dependencies span all three, and each registry names the
same idea differently: `dist-tags.latest` vs `info.version` vs a tag list,
`time.created` vs an upload timestamp vs `date_registered`. Every row here has
the same keys regardless of origin, so you can sort a whole audit by
`daysSinceRelease` in one pass.

#### How do I find unmaintained dependencies?

Sort by `daysSinceRelease`, or set `staleAfterDays` and filter on `isStale`. Also
check `deprecated`, which maps npm's deprecation flag, PyPI's *Inactive*
classifier and Docker's inactive status onto one field.

#### Why are PyPI download counts null?

Because PyPI removed download statistics from its API in 2016. The numbers now
live in a public BigQuery dataset. Third-party mirrors exist and some tools
present their figures as if they came from PyPI. A number whose provenance you
cannot check is worse than an empty field, so this returns `null` and says why.
npm download counts are real, from npm's own downloads API.

#### Does it resolve transitive dependencies?

No. `dependencies` lists direct dependencies only. Resolving the full tree means
guessing at version ranges, which is a different job and a different kind of
answer.

#### How many packages can I check in one run?

Up to 500.

#### Is `docker:nginx` the same as `docker:library/nginx`?

Yes. Docker names without a slash are resolved to the official `library/`
namespace.

# Actor input Schema

## `packages` (type: `array`):

One per line. A bare name uses the Registry setting below. Prefix to mix registries in one run: npm:express, pypi:requests, docker:nginx.

## `registry` (type: `string`):

Which registry a package name without a prefix belongs to.

## `staleAfterDays` (type: `integer`):

Sets isStale=true on any package whose newest release is older than this. 365 is a common threshold for a dependency review. Leave at 0 to skip the check.

## `proxyConfiguration` (type: `object`):

Proxy settings.

## `maxItems` (type: `integer`):

A hard ceiling on rows for the entire run, across every target. The per-target limits above cap each one separately, so fifty targets at twenty each is still a thousand rows; this caps the total. The run stops cleanly when it is reached and nothing beyond that point is fetched or charged. Leave empty for no ceiling.

## Actor input object example

```json
{
  "packages": [
    "express",
    "pypi:requests",
    "docker:nginx"
  ],
  "registry": "npm",
  "staleAfterDays": 365,
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}
```

# Actor output Schema

## `results` (type: `string`):

Version, license, release history, age in days, dependencies and a stale flag.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "express",
        "pypi:requests",
        "docker:nginx"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("glitchbound/packages-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packages": [
        "express",
        "pypi:requests",
        "docker:nginx",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("glitchbound/packages-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "express",
    "pypi:requests",
    "docker:nginx"
  ]
}' |
apify call glitchbound/packages-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=glitchbound/packages-scraper",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/G7SLdpG9qn9mcasbC/builds/6PImrVEvYxNd8wFDE/openapi.json