npm + PyPI Package Release & Supply-Chain Monitor

Track public npm and PyPI package releases, dependencies, maintainers, licenses, artifact hashes, deprecations/yanks, and meaningful changes across scheduled runs.

This Actor is designed for developer tooling, dependency intelligence, release watching, CI/CD automation, software supply-chain monitoring, and AI-agent workflows. It uses public JSON registry endpoints only: no browser, no API key, and no proxy are required.

What it monitors

For each npm or PyPI package, the Actor produces a normalized PACKAGE_SNAPSHOT with:

• registry-qualified stable package identity;
• latest version and release timestamp;
• description, license, author, maintainers/publisher;
• homepage, repository, and project URLs;
• npm runtime / optional / peer dependencies;
• PyPI requires_dist and requires_python;
• bounded newest-first release history;
• latest npm tarball integrity/shasum/signature-key metadata;
• latest PyPI distribution SHA-256 / BLAKE2b / MD5 hashes and yank state;
• npm public download counts for last day, week, or month;
• deterministic metadata, dependencies, maintainers, artifact, and supply-chain snapshot hashes.

When monitoring is enabled, state is persisted across runs and the Actor emits deterministic CHANGE records.

Change types

• NEW — first observed package baseline.
• UNCHANGED — monitored supply-chain state did not change.
• NEW_VERSION — latest version changed.
• DEPENDENCY_CHANGED — normalized dependency state changed.
• MAINTAINER_CHANGED — normalized maintainer state changed.
• LICENSE_CHANGED — license changed.
• DEPRECATED / DEPRECATION_REMOVED — npm latest-version deprecation state changed.
• YANKED / UNYANKED — current PyPI release yank state changed.
• ARTIFACT_CHANGED — hashes/artifact metadata changed without a latest-version change.
• DOWNLOAD_SPIKE / DOWNLOAD_DROP — npm download count changed beyond the configured percentage threshold.
• METADATA_CHANGED — other normalized metadata changed when no more specific supply-chain change explains it.

Example input

{
  "npmPackages": [
    "react",
    "typescript",
    "@types/node"
  ],
  "pypiPackages": [
    "fastapi",
    "pydantic",
    "httpx"
  ],
  "maxPackages": 50,
  "includeDependencies": true,
  "includeReleaseHistory": true,
  "maxReleaseHistory": 20,
  "includeDownloadStats": true,
  "downloadPeriod": "last-week",
  "monitorMode": true,
  "emitChangesOnly": false,
  "baselineOnly": false,
  "monitorKey": "production-dependencies",
  "downloadChangeThresholdPercent": 50,
  "concurrency": 10,
  "requestTimeoutSeconds": 20,
  "maxRetries": 2
}

Example package snapshot

{
  "recordType": "PACKAGE_SNAPSHOT",
  "status": "SUCCESS",
  "registry": "npm",
  "packageName": "react",
  "packageKey": "npm:react",
  "latestVersion": "19.x.x",
  "license": "MIT",
  "deprecated": false,
  "dependencyCount": 0,
  "downloadStats": {
    "period": "last-week",
    "downloads": 12345678,
    "start": "2026-08-17",
    "end": "2026-08-23"
  },
  "snapshotHash": "...",
  "checkedAt": "2026-08-29T00:00:00Z"
}

Example change record

{
  "recordType": "CHANGE",
  "status": "SUCCESS",
  "registry": "pypi",
  "packageName": "fastapi",
  "packageKey": "pypi:fastapi",
  "latestVersion": "0.x.x",
  "changeType": "NEW_VERSION",
  "previousValue": "0.x.x",
  "currentValue": "0.x.x",
  "checkedAt": "2026-08-29T00:00:00Z"
}

Recommended monitoring workflow

1. Run with monitorMode: true and a stable monitorKey.
2. The first run saves the package baseline and emits NEW unless baselineOnly is enabled.
3. Run the same input again on a schedule.
4. Unchanged packages emit UNCHANGED in normal monitor mode.
5. Set emitChangesOnly: true for automation/webhook pipelines that should receive only meaningful changes.

Keep the same package intelligence options across related monitor runs. Turning dependency/release fields on or off changes the normalized state by design.

Public data sources

npm

The Actor reads package metadata from the public npm registry package endpoint and optionally reads point download statistics from npm's public download-count service.

The npm registry response provides the package metadata document, including dist-tags, versions, dependencies, maintainers, repository fields, distribution hashes, and other version metadata.

PyPI

The Actor reads the PyPI project JSON endpoint. The project response includes project metadata, all release keys/files, distribution digests, and current project URLs.

Important: PyPI documents its JSON downloads field as deprecated and always -1. This Actor therefore does not fabricate PyPI download counts. downloadStats is null for PyPI records.

Reliability and cost design

This Actor is deliberately HTTP-only:

• no Playwright/Chromium;
• no residential proxy;
• no Apify Unblocker;
• no CAPTCHA/Cloudflare bypass;
• no third-party API key.

That keeps startup time, memory, platform usage, and maintenance risk low compared with website-specific scraping Actors.

Transient network errors, HTTP 429, and 5xx responses use bounded retries. A missing or failed package becomes an ERROR record without aborting successful packages in the same run.

Pay Per Event

The initial monetization configuration defines one primary custom event:

• Package processed — $0.0005 for each successfully fetched and normalized npm/PyPI package.

Failed package fetches are not charged by the Actor's custom event.

At the configured event price, 1,000 successfully processed packages correspond to $0.50 in Actor event charges, excluding underlying Apify platform usage.

Output

Structured results are written to the default dataset as:

• PACKAGE_SNAPSHOT
• CHANGE
• ERROR

RUN_SUMMARY is written to the default key-value store and includes package counts, registry counts, changes, errors, monitoring mode, billing counts, and charge-limit diagnostics.

Limitations

• Registry metadata reflects what package publishers/registries expose publicly; it is not an independent identity verification system.
• vulnerabilityCount, when present from a source response, is not a complete transitive dependency vulnerability audit.
• npm download spike/drop monitoring compares rolling public point counts. Large changes can reflect real usage shifts, reporting windows, or upstream data behavior.
• PyPI download statistics are intentionally omitted because the official project JSON API does not provide usable download counts.
• This Actor is a release and supply-chain metadata monitor, not a replacement for SCA, SBOM, malware analysis, or vulnerability scanners.