GitHub Repository Audit — Archived, Moved & Relicensed Packages

Compare public npm or PyPI package metadata with the current public GitHub repository state. The Actor highlights public signals that a registry alone may not make obvious: package deprecation, repository archival, repository moves, and known license differences.

Public source behavior

The Actor reads only public package-registry JSON and public GitHub REST responses. It does not use GitHub credentials, access private repositories, bypass login/CAPTCHA/rate limits, or call external services. A registry-declared repository is compared with the current GitHub owner/name, archive state, license, stars, forks, issue count, and public activity timestamps.

Input

{
  "packages": [
    { "registry": "npm", "name": "axios", "version": "1.7.9" },
    { "registry": "pypi", "name": "requests" }
  ],
  "maxItems": 10,
  "requestDelayMs": 250,
  "maxRetries": 1,
  "timeoutSecs": 30
}

Supported registries are npm and pypi. An exact version is preferred for version-specific deprecation and license comparisons; omitting it uses the public registry’s latest metadata. repositoryUrl can override incomplete public registry metadata. Package count, pacing, retries, and timeout are bounded.

Dataset output

Normal rows contain package registry/name/version, registry-declared repository and license, current public GitHub identity/archive/redirect/license/activity fields, auditComplete, auditFlags, and licenseComparison (match, different, or unknown). A missing registry repository is represented as an incomplete normal audit with repository_missing_from_registry. Failed requests are minimal diagnostics containing only url, error, errorCode, and scrapedAt. Operational counts and status are stored in the OUTPUT key-value record.

{
  "sourceUrl": "https://api.github.com/repos/axios/axios",
  "packageRegistry": "npm",
  "packageName": "axios",
  "packageVersion": "1.7.9",
  "githubFullName": "axios/axios",
  "githubArchived": false,
  "repositoryMoved": false,
  "licenseComparison": "match",
  "auditFlags": [],
  "scrapedAt": "2026-09-08T00:00:00.000Z"
}

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel.

Local run and validation

npm ci
npm test
npm run check
npm run lint
apify validate-schema
apify run --purge --input-file test/inputs/live-smoke.json
npm run validate

Keep audits bounded and respect npm, PyPI, and GitHub terms and public rate limits. The audit flags are evidence for review, not legal, security, licensing, revenue, or employment conclusions.