npm Package Stats

Fetch npm package metadata, versions, dependencies, repository links, maintainers, and download counts from public npm registry APIs.

What it does

For each npm package name you provide, this actor:

• Pulls the full package metadata from https://registry.npmjs.org/<pkg> (description, license, homepage, repository, keywords, maintainers, all published versions, latest version, dependency + devDependency counts on the latest manifest).
• Pulls the download count for a configurable period (last-day, last-week, last-month) from https://api.npmjs.org/downloads/point/<period>/<pkg>.
• Optionally includes the N most recent versions (version string + publish timestamp), sorted newest-first.

Both sources are keyless public APIs — no API key, no account, no captcha, no proxy required.

Inputs

Field	Type	Default	Notes
packages	array of strings	["react", "lodash", "typescript"]	Up to 200 per run. Bare package names.
downloadPeriod	enum	"last-month"	last-day / last-week / last-month
includeVersions	boolean	false	When true, include the N most recent versions.
maxVersions	integer (1-50)	5	Capped at 50. Ignored if includeVersions=false.
includeDependencies	boolean	true	When false, dependency counts are null (cheaper).

Output (one record per package)

{
  "packageName": "react",
  "description": "React is a JavaScript library for building user interfaces.",
  "latestVersion": "19.2.7",
  "license": "MIT",
  "homepage": "https://react.dev/",
  "repositoryUrl": "https://github.com/facebook/react",
  "npmUrl": "https://www.npmjs.com/package/react",
  "downloads": 634528403,
  "downloadPeriod": "last-month",
  "maintainers": ["fb", "react-bot"],
  "keywords": ["react"],
  "dependenciesCount": 0,
  "devDependenciesCount": 0,
  "versionsCount": 2863,
  "recentVersions": null,
  "fetchedAt": "2026-07-10T07:28:52.038Z",
  "sourceUrls": [
    "https://registry.npmjs.org/react",
    "https://api.npmjs.org/downloads/point/last-month/react"
  ]
}

If a package fails to resolve (typo, withdrawn, network error), the actor pushes a per-package error record with packageName, error, sourceUrl, downloadPeriod, and fetchedAt so the failure is visible in the dataset without losing the rest of the run.

Sources

• https://registry.npmjs.org/<package> — full package document (versions, maintainers, time, dist-tags, license, repository, keywords, etc.).
• https://api.npmjs.org/downloads/point/<period>/<package> — official npm downloads API.

Both endpoints are public. Be polite: the actor adds a small delay between requests to stay well under any reasonable rate limit.

Local run

make install    # one-time
make run        # local test with .actor/input.json
make push       # build Docker image and push to Apify
make run-prod   # smoke test against the published build

License

MIT.