Package Intelligence — npm & PyPI

Profile any npm or PyPI package from the official registry APIs: downloads, versions, maintainers, licence, freshness, deprecation — plus derived risk flags for supply-chain audits.

What you get per package

Facts: name · description · latestVersion · versionCount · license · homepage · repository · keywords · maintainers / maintainerCount · createdAt · lastPublishedAt · dependencyCount · hasTypes (npm) · requiresPython / classifiers (PyPI) · downloadsLastMonth (npm)

Derived signals — the part you would otherwise compute yourself:

Flag	Meaning
DEPRECATED	the maintainer marked it deprecated
UNMAINTAINED_2Y	no release in over two years
STALE_1Y	no release in over a year
SINGLE_MAINTAINER	bus-factor of one
NO_LICENSE	no licence declared — a legal problem in commercial code
HEAVY_DEPENDENCIES	more than 30 direct dependencies
YANKED_RELEASE	a release was pulled (PyPI)

Plus riskScore (0–100), daysSincePublish and maintained.

Two modes

Audit a list — pass your package.json or requirements.txt names and set onlyRisky: true to get back only the ones that need attention. That is a supply-chain review in one run.

Map a space — pass a searchQuery like "pdf parser" and it discovers packages via npm search, then profiles every one. Useful for competitive research and for choosing a dependency on evidence rather than vibes.

Input

{
  "packages": ["express", "lodash", { "name": "requests", "ecosystem": "pypi" }],
  "onlyRisky": true,
  "minDownloads": 1000
}

Why it is reliable

Everything comes from registry.npmjs.org, api.npmjs.org and pypi.org — official, free, documented APIs with no anti-bot. One deliberate omission: pypistats.org is not used, because it rate-limits plain requests with HTTP 429, so PyPI rows carry no download count rather than an unreliable one.

Typical uses

Supply-chain and licence audits · dependency due diligence before adopting a package · dev-tool companies tracking ecosystem adoption · security teams flagging unmaintained dependencies · investors measuring OSS traction · maintainers benchmarking against alternatives.