NPM Package Analyzer

What does NPM Package Analyzer do?

NPM Package Analyzer pulls comprehensive metrics for any list of npm packages in a single run — no API key required. It combines data from the npm registry, the npm Downloads API, Bundlephobia (bundle size), and the npm Security Advisories API to give you a full picture of every package: download trends, bundle size, known CVEs, dependency count, version history, and maintainer details.

This is the definitive npm package metrics tool for developers, security engineers, and decision-makers who need objective package health data before adding a dependency or auditing their existing stack.

---

Why use NPM Package Analyzer?

Audit npm packages for security, popularity, and maintenance health without writing your own API integration or stitching together multiple CLI tools.

1. Dependency due diligence — Before adding a new library, run an npm security audit alongside download stats and bundle size to make an informed decision. Catch abandoned packages and known CVEs before they enter your codebase.
2. Supply chain security monitoring — Security teams can schedule weekly scans of their production dependency list and alert on newly disclosed vulnerabilities or packages with zero recent downloads (potential abandonment).
3. Node.js package metrics for engineering reports — Engineering managers can track which internal or external packages are growing in adoption versus declining, and report bundle size trends across quarters.
4. Open-source investment research — Analysts tracking OSS ecosystems can monitor npm package download trends as a proxy for developer mindshare and platform adoption velocity.
5. Tech stack migration planning — Compare two competing packages (e.g. moment vs date-fns) across downloads, bundle size, vulnerabilities, and last-publish date to justify migration decisions with data.

---

How to use NPM Package Analyzer

1. Open the actor on Apify and click Try for free.
2. Enter your list of package names (e.g. ["express", "lodash", "axios"]).
3. Toggle optional sections:
   • Include Bundle Size — fetches minified + gzipped size from Bundlephobia.
   • Include Vulnerabilities — checks npm Security Advisories for known CVEs.
   • Include Download Trend — fetches weekly and monthly download counts.
4. Set Max Version History (1–50 recent versions).
5. Click Start and retrieve results from the dataset.

---

Input

Field	Type	Default	Description
packages	array	(required)	List of npm package names to analyze (e.g. ["react", "vue", "lodash"]).
includeBundleSize	boolean	true	Fetch minified and gzipped bundle size from Bundlephobia.
includeVulnerabilities	boolean	true	Check npm Security Advisories for known CVEs and severity ratings.
includeDownloadTrend	boolean	true	Fetch weekly and monthly download counts from the npm Downloads API.
maxVersions	integer	10	Maximum number of recent versions to include in version history (1–50).

---

Output

Each item in the dataset represents one analyzed npm package.

[
  {
    "name": "axios",
    "version": "1.7.2",
    "description": "Promise based HTTP client for the browser and node.js",
    "homepage": "https://axios-http.com",
    "license": "MIT",
    "author": "Matt Zabriskie",
    "maintainers": ["jasonsaayman", "nickuraltsev"],
    "repository": "https://github.com/axios/axios",
    "downloads_last_week": 48293812,
    "downloads_last_month": 192847300,
    "bundle_size_minified_bytes": 45678,
    "bundle_size_gzipped_bytes": 14231,
    "dependencies_count": 4,
    "dev_dependencies_count": 22,
    "vulnerabilities": [],
    "last_published_at": "2024-04-15T12:30:00Z",
    "version_history": [
      {"version": "1.7.2", "published_at": "2024-04-15T12:30:00Z"},
      {"version": "1.7.1", "published_at": "2024-03-20T09:00:00Z"}
    ],
    "analyzed_at": "2026-09-02T10:15:00Z"
  },
  {
    "name": "left-pad",
    "version": "1.3.0",
    "downloads_last_week": 12847,
    "downloads_last_month": 51034,
    "vulnerabilities": [],
    "last_published_at": "2017-03-22T00:00:00Z",
    "analyzed_at": "2026-09-02T10:15:00Z"
  }
]

---

Data fields

Field	Type	Description
name	string	npm package name
version	string	Latest published version
description	string	Package description from registry
homepage	string	Project homepage URL
license	string	SPDX license identifier
author	string	Primary author name
maintainers	array	List of npm maintainer usernames
repository	string	Source code repository URL
downloads_last_week	integer	Weekly download count from npm Downloads API
downloads_last_month	integer	Monthly download count
bundle_size_minified_bytes	integer	Minified bundle size in bytes (Bundlephobia)
bundle_size_gzipped_bytes	integer	Gzipped bundle size in bytes
dependencies_count	integer	Number of production dependencies
dev_dependencies_count	integer	Number of dev dependencies
vulnerabilities	array	Known CVEs from npm Security Advisories with severity rating
last_published_at	string	Timestamp of most recent publish to npm
version_history	array	Recent versions with publish timestamps
analyzed_at	string	ISO 8601 timestamp of the analysis run

---

Cost estimation

This actor uses Pay-Per-Event (PPE) pricing.

Scenario	Packages	Cost
Single package audit	1	$0.008
Small project (10 packages)	10	$0.035
Full dependency audit (50 packages)	50	$0.155
Large monorepo (200 packages)	200	$0.605

Pricing breakdown:

• $0.005 — actor start (one-time per run)
• $0.003 — per npm package successfully analyzed

---

FAQ

Does this actor require an npm API key or login? No. The npm package analyzer uses only public APIs: the npm registry (registry.npmjs.org), npm Downloads API, Bundlephobia, and npm Security Advisories. No authentication is required.

How current is the vulnerability data? Vulnerability data comes from the official npm Security Advisories API, which is the same source powering npm audit. It reflects the current state of the advisory database at the time of the run. Schedule the actor weekly to catch newly disclosed CVEs.

Can I analyze private or scoped packages? Scoped packages (e.g. @company/package) are fully supported — just include the full scoped name in your list. Private registry packages are not supported; the actor only queries the public npm registry.

---

Disclaimer: This actor uses public APIs including the npm registry, npm Downloads API, Bundlephobia, and npm Security Advisories. Vulnerability data is advisory only and does not guarantee a package is secure or insecure. Always perform your own security due diligence before making production dependency decisions. This actor is not affiliated with or endorsed by npm, Inc. or GitHub, Inc.

---

Related actors

• NPM Package Trends — Download trend sparklines for packages analyzed by this actor
• NPM Package Security Scanner — Deeper CVE and supply chain risk for packages identified as vulnerable here
• GitHub Repo Analytics — GitHub stars and contributor activity for the source repos of npm packages

Feedback

If this actor powers your dependency research, a review helps others find it: Leave a review on Apify Store

---

Keywords: npm package analyzer, npm dependency audit, bundle size checker, npm package metadata, package.json analyzer, npm vulnerability check, tree-shaking analysis, npm license checker, direct dependencies, peer dependencies, npm registry scraper, JavaScript package health, npm package quality, dependency tree, package maintenance score