npm & PyPI Package Intelligence - downloads, vulnerabilities, risk score

Audit and compare open-source packages in one run. For every npm or PyPI package you get registry facts, a real downloads trend, maintainers, licence, release cadence, GitHub repo health, known vulnerabilities from the OSV database and an explained 0-100 risk score. Paste a whole package.json or requirements.txt and audit every dependency at once.

No API keys, no login, no browser. All data comes from public registry and advisory APIs.

What you get per package

Group	Fields
Identity	name - ecosystem - url - description - keywords - latestVersion - versionCount - distTags (npm)
Adoption	downloadsLastWeek - downloadsLastMonth - downloadsPreviousMonth - downloadsTrendPct - weeklyDownloads[] (12 weeks, npm) - dependentPackages - dependentRepos - popularityPercentile
People & legal	maintainers[] - maintainerCount - author - license
Release cadence	createdAt - lastPublishedAt - daysSincePublish - releasesLast12Months - releaseCadenceDays (median gap of the last 10 releases)
Dependencies	dependencies[] (name, range) - dependencyCount - devDependencyCount - peerDependencies - hasTypes - nodeEngine / requiresPython - hasInstallScripts (npm)
GitHub repo	repositoryUrl - repoStars - repoForks - repoOpenIssues - repoLastPushAt - repoArchived - repoLanguage
Vulnerabilities	checkedVersion - versionSource - vulnerabilityCount - vulnerabilities[] (id, cve, severity, summary, fixedIn, url) - latestVersionVulnerabilityCount
Health	deprecated - deprecationMessage - yanked - isOutdated - majorVersionsBehind - maintained
Risk	riskScore (0-100) - riskLevel (low / medium / high / critical) - flags[] - riskFactors[] (every flag with its points and a one-line reason)

Example row (shortened)

{
  "type": "package",
  "ecosystem": "npm",
  "name": "lodash",
  "latestVersion": "4.18.1",
  "declaredRange": "^4.17.15",
  "checkedVersion": "4.17.15",
  "versionSource": "range-minimum",
  "downloadsLastMonth": 669494636,
  "downloadsTrendPct": -7.1,
  "maintainerCount": 1,
  "license": "MIT",
  "releasesLast12Months": 3,
  "repoStars": 61276,
  "repoLastPushAt": "2026-09-11T18:02:54.000Z",
  "vulnerabilityCount": 6,
  "vulnerabilities": [
    { "id": "GHSA-35jh-r3h4-6jhm", "cve": "CVE-2021-23337", "severity": "HIGH",
      "summary": "Command Injection in lodash", "fixedIn": ["4.17.21"] }
  ],
  "latestVersionVulnerabilityCount": 0,
  "flags": ["VULNERABLE_VERSION", "SINGLE_MAINTAINER"],
  "riskScore": 43,
  "riskLevel": "high",
  "riskFactors": [
    { "flag": "VULNERABLE_VERSION", "points": 35, "detail": "6 known advisories affect 4.17.15 (worst: HIGH)" },
    { "flag": "SINGLE_MAINTAINER", "points": 8, "detail": "Only one registry maintainer (bus factor 1)" }
  ]
}

How the risk score works

The score is the sum of the factors below (capped at 100), and each row lists exactly which factors fired, so the number can be defended in a review. 0-14 low, 15-34 medium, 35-59 high, 60+ critical.

Flag	Points	Meaning
DEPRECATED	40	marked deprecated by its maintainers (PyPI: "Inactive" classifier)
VULNERABLE_VERSION	8 / 20 / 35 / 45	known advisories affect the checked version (low / medium / high / critical worst severity)
UNMAINTAINED_2Y / STALE_1Y	25 / 10	no release for two years / one year
REPO_ARCHIVED / REPO_INACTIVE	20 / 10	GitHub repo archived / no commit for two years
YANKED_RELEASE	15	the latest release was yanked (PyPI)
OUTDATED_MAJOR	10	your declared version is a major version behind
NO_LICENSE	10	no licence declared
SINGLE_MAINTAINER	8	bus factor of one
HEAVY_DEPENDENCIES / NO_REPOSITORY / LOW_ADOPTION / DOWNLOADS_DECLINING	5	large attack surface / no source link / under 500 downloads a month / downloads fell 40% or more
INSTALL_SCRIPTS	3	runs install/postinstall scripts (npm)

Which version is checked for vulnerabilities?

• A package given with a version (lodash@4.17.15, requests==2.19.0, or a pinned line in your manifest) is checked at exactly that version (versionSource: "pinned").
• A range such as ^4.17.15 is checked at its lowest allowed version ("range-minimum") - the worst case your lockfile could still resolve to. latestVersionVulnerabilityCount tells you whether upgrading fixes it.
• No version at all means the latest release ("latest").

Input

{
  "packages": ["express", "pypi:requests", "@angular/core", "lodash@4.17.15"],
  "packageJson": "{ \"dependencies\": { \"express\": \"^4.17.1\" } }",
  "requirementsTxt": "requests==2.19.0\nflask>=1.0",
  "manifestUrls": ["https://github.com/expressjs/express/blob/master/package.json"],
  "searchQuery": "pdf parser",
  "onlyRisky": true,
  "minRiskScore": 35
}

Use any combination of packages, packageJson, requirementsTxt, manifestUrls and searchQuery. With {} the Actor profiles express and lodash.

Use cases

• Supply-chain audit - paste your manifests, set onlyRisky: true, and get only the dependencies that need attention, each with the advisory and the fixed version.
• Due diligence before adopting a package - compare maintainers, release cadence, downloads trend and repo health across candidates found with searchQuery.
• Licence review - sort by license and NO_LICENSE.
• Ecosystem research and investing - weekly downloads, dependents and stars measure OSS traction.
• Scheduled monitoring - run weekly on your manifests; new advisories show up as new vulnerabilities.

FAQ

Which data sources are used? registry.npmjs.org and api.npmjs.org, pypi.org and pypistats.org, the OSV database (api.osv.dev) for advisories, and ecosyste.ms for dependents and GitHub repo statistics.

Why is downloadsTrendPct empty for PyPI? PyPI only publishes last-week and last-month totals, no daily history, so there is no previous period to compare.

Does it need a GitHub token? No. Repo stats come from ecosyste.ms, with an unauthenticated GitHub call as fallback.

What happens when one package fails? It becomes a type: "error" row with the reason; the other packages are still returned and failed packages are never billed.

Can it search PyPI? PyPI has no search API, so discovery by searchQuery covers npm only. PyPI packages can be supplied by name or requirements.txt.

Is the vulnerability check complete? It covers every advisory in OSV for that exact package and version (GitHub Security Advisories, PyPA, CVE data). It does not analyse whether your code actually calls the vulnerable function.

How is pricing counted? Per package row delivered (event package-checked) plus one search-run when you use search. Packages dropped by onlyRisky, minRiskScore or minDownloads are not billed.

Output

Dataset rows have type = package or error. A SUMMARY record in the key-value store lists counts, the ten highest-risk packages and any input problems.