# npm / PyPI Package Checker (`gogumaa/npm-pypi-package-checker`) Actor

Verify npm and PyPI package names before installing: exists, latest version, last publish, weekly downloads, license, repo, deprecation, OSV vulnerabilities, typosquat suspicion. Official JSON APIs only.

- **URL**: https://apify.com/gogumaa/npm-pypi-package-checker.md
- **Developed by:** [gogumaa](https://apify.com/gogumaa) (community)
- **Categories:** Developer tools, AI, Other
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$2.00 / 1,000 package checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## npm / PyPI Package Checker

**Stop slopsquatting before `npm install`.** LLM coding agents hallucinate package names; attackers register them. Call this Actor with the names your agent is about to install and get back, per package: does it exist, how old and how popular is it, is it deprecated or yanked, known OSV vulnerabilities, and whether the name is an edit-distance-≤2 lookalike of a popular package. Official registry JSON APIs only — no scraping, no browser.

**npm / PyPI package checker: verify npm and PyPI names via the official registry APIs, no login or API key, pay per result.** Not a scraper in the HTML sense; every field comes from public JSON APIs (npm, PyPI, pypistats, OSV.dev).

### What you can do with it

- **Agent guardrail ("Actors as tools")** — your agent proposes dependencies → call this Actor via MCP/API → refuse anything with `exists: false` or `typosquat_suspect: true`.
- **Dependency audit** — paste a `package.json` / `requirements.txt` name list, get license, repo, last publish and vuln count in one table.
- **Dead-package monitoring** — run weekly on your deps, alert on `deprecated`, falling `weekly_downloads`, or `last_publish` older than N years.
- **Name availability** — `exists: false` for a name you want to publish.
- **Automation** — Schedule it on Apify and pipe results to Google Sheets, Slack, n8n or Make via the Apify integration.
- **CI pre-merge check** — call the Actor from CI with newly added dependency names and fail the build on `osv_count > 0` or `typosquat_suspect: true`.

### Output example

```json
{
  "name": "lodahs",
  "ecosystem": "npm",
  "exists": false,
  "osv_count": 0,
  "osv_vulns": [],
  "typosquat_suspect": true,
  "typosquat_of": "lodash"
}
```

```json
{
  "name": "requests",
  "ecosystem": "pypi",
  "exists": true,
  "url": "https://pypi.org/project/requests/",
  "latest_version": "2.32.5",
  "last_publish": "2025-08-18T20:46:00.542Z",
  "weekly_downloads": 353421454,
  "license": "Apache-2.0",
  "repo": "https://github.com/psf/requests",
  "description": "Python HTTP for Humans.",
  "deprecated": false,
  "osv_count": 0,
  "osv_vulns": [],
  "typosquat_suspect": false,
  "typosquat_of": null
}
```

### Input

| Field | Default | Notes |
|---|---|---|
| `packages` | — | Names to check. npm scoped names (`@scope/pkg`) are fine. One result row per name. |
| `ecosystem` | `auto` | `npm`, `pypi`, or `auto` (try npm first, then PyPI; the row's `ecosystem` tells you which matched). |
| `maxItems` | 100 | Stop after this many packages. |

### Fields

- `exists` — registry returned the package.
- `latest_version`, `last_publish` — from the registry's latest dist-tag / release.
- `weekly_downloads` — npm downloads API (last 7 days) or pypistats `last_week`.
- `license` — SPDX string where the registry has one, otherwise the classifier/license text.
- `repo` — normalised `https://` URL from `repository` (npm) or `project_urls` (PyPI).
- `deprecated` — npm deprecation message, PyPI yanked reason, or `false`.
- `osv_vulns` — OSV.dev advisory IDs affecting `latest_version`; `osv_count` is the length.
- `typosquat_suspect` / `typosquat_of` — name is within Damerau-Levenshtein distance 2 of a popular package in that ecosystem (and is not itself that package). Review manually: short names produce false positives.

### Pricing

Pay per package checked. A non-existent package still costs one event (the lookup was done).

### FAQ

#### Do I need an API key or account?

No. The npm registry, PyPI, pypistats and OSV.dev are all public and keyless. pypistats rate-limits heavily, so PyPI `weekly_downloads` can occasionally be missing on large batches.

#### How much does it cost?

$0.002 per result and nothing else: with pay-per-event pricing you are not billed for Apify compute. 100 results cost $0.20, and the Apify free plan's $5 monthly credit covers about 2,500 results. Rows that are never produced are never charged.

#### How do I get the data into Google Sheets / my app?

Every run writes to an Apify dataset you can download as CSV, JSON or Excel, or read from the dataset API endpoint. For ongoing feeds, use Apify integrations (Google Sheets, Slack, Zapier, Make, n8n) or call the Actor from your own code with the Apify API.

#### Is it legal / allowed?

It only reads public data via the platform's public API and respects rate limits. You are responsible for complying with npm and PyPI's terms and applicable law.

#### Does a typosquat flag mean the package is malicious?

No. `typosquat_suspect` only means the name is within edit distance 2 of a popular package in the same ecosystem. Short names produce false positives, so treat it as a prompt for manual review. A non-existent package still costs one event, since the lookup was done.

### Related Actors

- [WordPress.org Plugin Scraper](https://apify.com/gogumaa/wordpress-plugin-scraper)
- [Hugging Face Hub Scraper](https://apify.com/gogumaa/huggingface-hub-scraper)
- [DEV Community Articles Scraper](https://apify.com/gogumaa/devto-articles-scraper)

# Actor input Schema

## `packages` (type: `array`):

Names to verify, e.g. lodash, @scope/pkg, requests. One row per package.

## `ecosystem` (type: `string`):

auto = try npm first, then PyPI.

## `maxItems` (type: `integer`):

Stop after this many packages.

## Actor input object example

```json
{
  "packages": [
    "lodash",
    "requests",
    "lodahs"
  ],
  "ecosystem": "auto",
  "maxItems": 100
}
```

# Actor output Schema

## `packages` (type: `string`):

One record per package: exists, ecosystem, latest_version, last_publish, weekly_downloads, license, repo, deprecated, osv_vulns, typosquat_suspect.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "lodash",
        "requests",
        "lodahs"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("gogumaa/npm-pypi-package-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packages": [
        "lodash",
        "requests",
        "lodahs",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("gogumaa/npm-pypi-package-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "lodash",
    "requests",
    "lodahs"
  ]
}' |
apify call gogumaa/npm-pypi-package-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,gogumaa/npm-pypi-package-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/islRieRHTUXKyFKKM/builds/m66K04n6HrxAPSqgk/openapi.json