npm / PyPI Package Checker

Stop slopsquatting before npm install. LLM coding agents hallucinate package names; attackers register them. Call this Actor with the names your agent is about to install and get back, per package: does it exist, how old and how popular is it, is it deprecated or yanked, known OSV vulnerabilities, and whether the name is an edit-distance-≤2 lookalike of a popular package. Official registry JSON APIs only — no scraping, no browser.

npm / PyPI package checker: verify npm and PyPI names via the official registry APIs, no login or API key, pay per result. Not a scraper in the HTML sense; every field comes from public JSON APIs (npm, PyPI, pypistats, OSV.dev).

What you can do with it

• Agent guardrail ("Actors as tools") — your agent proposes dependencies → call this Actor via MCP/API → refuse anything with exists: false or typosquat_suspect: true.
• Dependency audit — paste a package.json / requirements.txt name list, get license, repo, last publish and vuln count in one table.
• Dead-package monitoring — run weekly on your deps, alert on deprecated, falling weekly_downloads, or last_publish older than N years.
• Name availability — exists: false for a name you want to publish.
• Automation — Schedule it on Apify and pipe results to Google Sheets, Slack, n8n or Make via the Apify integration.
• CI pre-merge check — call the Actor from CI with newly added dependency names and fail the build on osv_count > 0 or typosquat_suspect: true.

Output example

{
  "name": "lodahs",
  "ecosystem": "npm",
  "exists": false,
  "osv_count": 0,
  "osv_vulns": [],
  "typosquat_suspect": true,
  "typosquat_of": "lodash"
}

{
  "name": "requests",
  "ecosystem": "pypi",
  "exists": true,
  "url": "https://pypi.org/project/requests/",
  "latest_version": "2.32.5",
  "last_publish": "2025-08-18T20:46:00.542Z",
  "weekly_downloads": 353421454,
  "license": "Apache-2.0",
  "repo": "https://github.com/psf/requests",
  "description": "Python HTTP for Humans.",
  "deprecated": false,
  "osv_count": 0,
  "osv_vulns": [],
  "typosquat_suspect": false,
  "typosquat_of": null
}

Input

Field	Default	Notes
packages	—	Names to check. npm scoped names (@scope/pkg) are fine. One result row per name.
ecosystem	auto	npm, pypi, or auto (try npm first, then PyPI; the row's ecosystem tells you which matched).
maxItems	100	Stop after this many packages.

Fields

• exists — registry returned the package.
• latest_version, last_publish — from the registry's latest dist-tag / release.
• weekly_downloads — npm downloads API (last 7 days) or pypistats last_week.
• license — SPDX string where the registry has one, otherwise the classifier/license text.
• repo — normalised https:// URL from repository (npm) or project_urls (PyPI).
• deprecated — npm deprecation message, PyPI yanked reason, or false.
• osv_vulns — OSV.dev advisory IDs affecting latest_version; osv_count is the length.
• typosquat_suspect / typosquat_of — name is within Damerau-Levenshtein distance 2 of a popular package in that ecosystem (and is not itself that package). Review manually: short names produce false positives.

Pricing

Pay per package checked. A non-existent package still costs one event (the lookup was done).

FAQ

Do I need an API key or account?

No. The npm registry, PyPI, pypistats and OSV.dev are all public and keyless. pypistats rate-limits heavily, so PyPI weekly_downloads can occasionally be missing on large batches.

How much does it cost?

$0.002 per result and nothing else: with pay-per-event pricing you are not billed for Apify compute. 100 results cost $0.20, and the Apify free plan's $5 monthly credit covers about 2,500 results. Rows that are never produced are never charged.

How do I get the data into Google Sheets / my app?

Every run writes to an Apify dataset you can download as CSV, JSON or Excel, or read from the dataset API endpoint. For ongoing feeds, use Apify integrations (Google Sheets, Slack, Zapier, Make, n8n) or call the Actor from your own code with the Apify API.

Is it legal / allowed?

It only reads public data via the platform's public API and respects rate limits. You are responsible for complying with npm and PyPI's terms and applicable law.

Does a typosquat flag mean the package is malicious?

No. typosquat_suspect only means the name is within edit distance 2 of a popular package in the same ecosystem. Short names produce false positives, so treat it as a prompt for manual review. A non-existent package still costs one event, since the lookup was done.

Related Actors

• WordPress.org Plugin Scraper
• Hugging Face Hub Scraper
• DEV Community Articles Scraper