Pricing

from $2.00 / 1,000 search runs

Try for free

Go to Apify Store

npm & PyPI Package Scraper - Downloads & Risk Flags

Try for free

Audit open-source dependencies fast. Profile any npm or PyPI package from the official registries: downloads, versions, maintainers, licence, freshness, deprecation, plus risk flags (DEPRECATED, UNMAINTAINED_2Y, SINGLE_MAINTAINER, NO_LICENSE) for supply-chain checks.

Pricing

from $2.00 / 1,000 search runs

Rating

0.0

(0)

Developer

mohamed alaya

Actor stats

Bookmarked

Total users

Monthly active users

18 days ago

Last modified

Categories

Open source

Developer tools

Business

Packages

packages

Optional

Package names, e.g. express, @angular/core, lodash@4.17.15, requests==2.19.0. Prefix with npm: or pypi: to mix ecosystems, or use objects: {"name":"requests","ecosystem":"pypi"}. Giving a version checks that exact version for vulnerabilities.

Type:array

Default:

[
  "express",
  "lodash"
]

Default ecosystem

ecosystem

Optional

Used for any package given as a plain name without an npm: or pypi: prefix.

Type:string

Default:npm

Options:

npmpypi

package.json contents

packageJson

Optional

Paste a whole package.json. Every dependency is audited, and the version range you declared is the version checked for known vulnerabilities. Leave empty to skip.

Type:string

Default:

Include devDependencies

includeDevDependencies

Optional

Also audit devDependencies from the pasted package.json or package.json URLs.

Type:boolean

Default:false

requirements.txt contents

requirementsTxt

Optional

Paste a whole requirements.txt. Pinned versions (requests==2.19.0) are checked for known vulnerabilities. Leave empty to skip.

Type:string

Default:

Manifest URLs

manifestUrls

Optional

Links to package.json or requirements.txt files, e.g. a GitHub blob or raw URL. They are downloaded and audited like the pasted contents.

Type:array

Default:

[]

Or discover by search

searchQuery

Optional

Search npm for this term and profile everything it finds - useful for mapping a space, e.g. "pdf parser". Leave empty to skip.

Type:string

Default:

Max search results

searchLimit

Optional

How many packages to pull from the search before profiling them.

Type:integer

Minimum:1

Maximum:250

Default:20

Check known vulnerabilities

checkVulnerabilities

Optional

Look every package version up in the open OSV vulnerability database (GitHub advisories, PyPA, CVEs) and list the advisories with severity and fixed versions.

Type:boolean

Default:true

Include GitHub repo health

includeRepoStats

Optional

Add stars, forks, open issues, last commit date and archived status of the linked GitHub repository, plus dependents counts.

Type:boolean

Default:true

Include the dependency list

includeDependencies

Optional

Include every direct dependency with its version range. Turn off to keep rows small.

Type:boolean

Default:true

Only packages with risk flags

onlyRisky

Optional

Return only packages with at least one risk flag (deprecated, vulnerable, unmaintained, archived repo, single maintainer, no licence...). This is the supply-chain audit mode and only returned packages are billed.

Type:boolean

Default:false

Minimum risk score

minRiskScore

Optional

Return only packages whose 0-100 risk score is at least this. 0 = no limit. 35 or more means high risk.

Type:integer

Minimum:0

Maximum:100

Default:0

Minimum monthly downloads

minDownloads

Optional

Drop packages below this download count in the last 30 days. 0 = no limit.

Type:integer

Minimum:0

Default:0

Max packages

maxPackages

Optional

Safety cap on how many packages are checked in one run (manifests and searches can be large).

Type:integer

Minimum:1

Maximum:2000

Default:200

Concurrency

concurrency

Optional

How many packages to look up in parallel.

Type:integer

Minimum:1

Maximum:20

Default:5

Proxy

proxyConfiguration

Optional

Optional proxy. Not needed normally - the registries do not block. If a source rate-limits the run, Apify's datacenter proxy is used automatically as a fallback.

Type:object

Default:

{
  "useApifyProxy": false
}

📦 npm Package Scraper - Downloads & Dependencies

benthepythondev/npm-package-scraper

Extract npm package data with download stats, dependencies, maintainers, and quality scores. Search by keyword, author, or get popular packages. Perfect for JavaScript ecosystem research, competitor tracking, and dependency analysis. Fast API-based extraction, pay-per-result.

Ben

Package Intelligence for npm and PyPI

agentictools/package-intelligence

Track npm and PyPI packages: download stats, versions, dependencies, license, and repository. For dependency monitoring and developer marketing.

Ken Agland

npm & PyPI Package Scraper — Downloads, Health & Maintenance

samwise.agency/package-intel

Package intelligence for npm and PyPI: download stats, publish recency, maintenance scores, license and repo metadata. Find abandoned dependencies, benchmark libraries, monitor your stack. Official APIs, keyless.

samwise.agency

npm Registry Intel: Packages, Releases & Maintainer Leads

obsidian937/npm-registry-intel

Turn the npm registry into structured B2B data. Discover packages by keyword or scope, monitor releases of any package list, or build developer lead lists from maintainer emails. Official public npm API, no proxy, no auth. Delta mode for recurring monitoring.

Obsidian IT Consulting SRL

npm, PyPI & crates.io Package Intelligence

optirefine/package-intelligence

Bulk package health, vulnerabilities and dependency data for npm, PyPI and crates.io. One row per package: version, licence, maintainers, downloads, OSV advisories, deps.dev dependency counts, and a 0-100 health score.

OptiRefine

PyPI Package Stats & Downloads

bgfc97/pypi-package-stats

Get PyPI (Python) package download counts (day/week/month) plus metadata: latest version, license, summary, author, requires-python and project links. Official PyPI + pypistats APIs. No key, no proxy.

Bruno

Package Intel: npm + PyPI Metadata & Vulnerability Scraper

studious_allergy_mig/package-intel-scraper

Normalized npm and PyPI package metadata plus OSV.dev vulnerability signals for dependency auditing and supply-chain monitoring.

Conor G

npm Package Stats & Downloads

bgfc97/npm-package-stats

Get npm package download counts (day/week/month/year) plus metadata: latest version, license, description, repository, maintainers and publish dates. Official npm APIs. No key, no proxy.

Bruno

NuGet Package Stats

brunofin/nuget-package-stats

Fetch NuGet (.NET) package metadata and statistics: version, total downloads, authors, license, dependencies, and release history via the official NuGet API.

Bruno Finger

Package Adoption Tracker: npm & PyPI Download Trends

scrapemint/package-adoption-tracker

Keyless download data for npm and PyPI packages: last week against the week before with growth percent, the 30 day total and daily series, plus keyword search across npm ranked by growth to find what is rising in a space. Pay per row.