npm, PyPI & Crates.io Package Health Checker

What is npm, PyPI & Crates.io Package Health Checker?

npm, PyPI & Crates.io Package Health Checker is an Apify Actor that answers the question every dependency review starts with: is this package still alive? Give it a list of packages — npm:react, pypi:requests, crates:serde — and it returns one clean row per package with the deprecation status, last publish date, release cadence, licence, weekly downloads, maintainer count, GitHub stars and archive flag, plus a 0-100 health score and an A-F grade.

It reads the official public registry APIs (registry.npmjs.org, pypi.org, crates.io) and the GitHub REST API. No API key, no proxy, no browser, no anti-bot handling — so a 1,000-package lock file costs a few cents of compute and finishes in minutes.

What data does Package Health Checker extract?

Package Health Checker extracts the maintenance and licence signals that decide whether a dependency is safe to keep:

Field	Type	Description
package	string	The reference you entered, e.g. npm:react
registry	string	npm, pypi or crates
name / description	string	Canonical name and one-line description
latestVersion	string	Latest published version
latestPublishedAt	string	ISO date of the latest release
daysSinceLastPublish	number	Staleness in days
firstPublishedAt / packageAgeDays	string/number	First release, age in days
versionCount	number	Total published versions
releasesLast12Months	number	Releases in the trailing 365 days
license	string	Licence identifier, e.g. MIT, MIT OR Apache-2.0
isDeprecated	boolean	npm deprecation, or a yanked PyPI/crates.io release
deprecationMessage	string	The maintainer's deprecation note
weeklyDownloads	number	Weekly download volume
maintainerCount	number	npm maintainers (null on PyPI and crates.io)
homepage / repositoryUrl	string	Project and source URLs
github	object	stars, forks, openIssues, archived, lastPushAt, license
riskFlags	array	deprecated, no-license, stale-18-months, stale-36-months, archived-repo, single-maintainer, low-downloads, no-repository
healthScore / healthGrade	number/string	0-100 and A-F
error / githubError / scrapedAt	string	Per-row failure reasons and timestamp

How to use Package Health Checker

1. Paste your packages into Packages, one per row, prefixed with the registry: npm:react, pypi:requests, crates:serde. Bare names such as react or @scope/name use Default registry; full registry URLs work too.
2. Leave Enrich with GitHub data on for stars, forks and the archived flag. For lists longer than ~50 packages, paste a GitHub token — anonymous GitHub calls are capped at 60 per hour.
3. Click Start, then download the results as JSON, CSV, Excel or HTML, or pull them from the dataset API.

Example input

{
  "packages": ["npm:react", "npm:request", "pypi:requests", "crates:serde", "npm:left-pad"],
  "defaultRegistry": "npm",
  "enrichGithub": true,
  "maxConcurrency": 5
}

Example output

{
  "package": "npm:left-pad",
  "registry": "npm",
  "name": "left-pad",
  "latestVersion": "1.3.0",
  "latestPublishedAt": "2018-04-09T01:10:45.796Z",
  "daysSinceLastPublish": 3078,
  "releasesLast12Months": 0,
  "license": "WTFPL",
  "isDeprecated": true,
  "deprecationMessage": "use String.prototype.padStart()",
  "weeklyDownloads": 1154291,
  "maintainerCount": 2,
  "repositoryUrl": "https://github.com/stevemao/left-pad",
  "github": { "stars": 1303, "forks": 139, "openIssues": 10, "archived": true, "lastPushAt": "2019-04-19T14:16:20.000Z" },
  "riskFlags": ["deprecated", "stale-36-months", "archived-repo"],
  "healthScore": 0,
  "healthGrade": "F",
  "scrapedAt": "2026-09-12T15:48:10.000Z"
}

Input parameters

Parameter	Type	Default	Description
packages	array	["react"]	Packages to check, one row each
defaultRegistry	string	npm	Registry for bare names (npm, pypi, crates)
enrichGithub	boolean	true	Add GitHub stars, forks, issues, archived flag
githubToken	string (secret)	none	Raises the GitHub limit from 60 to 5,000 requests/hour
maxConcurrency	integer	5	Parallel lookups (1-20)

Pricing

Package Health Checker uses pay-per-event pricing: $0.002 per package row ($2 per 1,000 packages), plus a negligible $0.00005 actor-start fee, with platform usage included. A 500-dependency audit therefore costs about $1. Set Maximum cost per run to cap spend — the Actor trims the list to what the budget covers instead of overrunning it.

Package Health Checker vs. Snyk Advisor and Socket

Snyk Advisor and Socket give you one beautifully rendered page per package, in a browser, one at a time. Package Health Checker gives you 500 packages as a spreadsheet in one run, on demand or on a schedule, with the same underlying registry facts and a score you can sort and filter. It is complementary rather than competing: this Actor covers maintenance, licence and popularity risk, not CVE matching or malware behaviour analysis — pair it with an advisory database such as OSV or GitHub Advisories for vulnerability data.

Using Package Health Checker with AI agents and MCP

Package Health Checker runs on pay-per-event pricing with limited permissions — the two requirements for an Actor to be callable through the Apify MCP server at mcp.apify.com. An agent reviewing a package.json, requirements.txt or Cargo.toml passes the dependency names as packages and gets back a scored row per dependency, ready to summarise. It also connects through n8n, Make, Zapier and LangChain via Apify's integrations.

FAQ

How is the health score calculated? Every package starts at 100 and loses points per risk flag: deprecated -50, archived repository -40, no release in 36 months -30 (18 months -15), no licence -15, no repository -10, fewer than 100 weekly downloads -10, a single npm maintainer -5. The score floors at 0. Grades: A >= 85, B >= 70, C >= 50, D >= 30, otherwise F.

Where do the download numbers come from? npm's own api.npmjs.org last-week endpoint, pypistats.org for PyPI, and crates.io's trailing-90-day figure divided by 13 for Rust crates. pypistats.org rate-limits aggressively; when it answers 429 the row keeps weeklyDownloads: null instead of failing.

Why is maintainerCount empty for Python and Rust packages? Only npm publishes the maintainer list in its public metadata. PyPI and crates.io do not, so the field is null and the single-maintainer flag never fires for them.

Does it detect vulnerabilities or CVEs? No. It measures maintenance, licence and popularity risk. Use it alongside a vulnerability scanner.

Does a package that is missing fail the whole run? No. A typo, a private package or an unsupported registry produces a row with error filled in and the other columns null, so you can see exactly which entries need attention.

Is this legal to run? Yes — it reads public registry metadata through official APIs and collects no personal data beyond the maintainer usernames npm already publishes.

Can I export to CSV or push results into my own tools? Yes. Download JSON, CSV, Excel or HTML from the Output tab, hit the dataset API, or wire the run into n8n, Make, Zapier, Slack or Google Sheets through Apify's integrations.

Related Actors

Part of the webdatatools web-intelligence suite — every Actor is pay-per-event, reads public data without a login, and returns one clean row per entity:

Browse the whole suite at webdatatools, or call ten of these Actors straight from Claude, Cursor or Cline with the webdatatools MCP server.

Website & domain intelligence

• Email Extractor — Website Contact & Social Finder — e-mails, phones and social profiles per domain
• Tech Stack Detector — Wappalyzer & BuiltWith Alternative — CMS, e-commerce, analytics, pixels and payments per domain
• Domain DNS & Email Security Checker — SPF, DKIM, DMARC, MX provider, registrar and domain age
• Domain Security Audit (TLS, HTTP headers, redirects, robots) — TLS expiry, security headers, redirect chain, robots and llms.txt
• Subdomain Finder (Certificate Transparency) — every subdomain seen in CT logs, with a live DNS check
• Bulk Core Web Vitals & PageSpeed Audit — Lighthouse scores, LCP, CLS, INP and top fixes per URL
• On-Page SEO Audit — title, meta, headings, links, images and schema issues per page
• Sitemap URL Extractor & Change Monitor — every sitemap URL, or new and removed pages between runs
• Wayback Machine Snapshot & Page Change Tracker — how a page changed over time, or every archived snapshot
• Bulk Domain WHOIS & RDAP Lookup — registrar, dates, status and nameservers per domain
• Web Scraper — CSS Selector & Data Extractor — pull any CSS selector off any page, one row per URL
• Website Screenshot Generator — full-page or viewport PNG/JPEG screenshots of any URL

Content for AI, LLMs and RAG

• AI Web Search & Read: Google results as clean Markdown — a query turned into clean Markdown from the top search results
• Website to Markdown — Content Crawler for LLM & RAG — any site as clean Markdown per page, no browser
• Article & News Extractor (clean text, author, date, markdown) — clean article text, author, date and Markdown per URL
• Structured Data & JSON-LD Extractor (Schema.org, Open Graph) — Schema.org and Open Graph data from any page
• Google News Scraper (RSS search by keyword, topic, site) — news results by keyword, topic or site
• Press Release Monitor: PR Newswire, BusinessWire, GlobeNewswire — PR Newswire, Business Wire and GlobeNewswire releases

Search, video and social

• YouTube Shorts Scraper — Shorts from channels, hashtags and searches with view counts
• Pinterest Pins Scraper — latest pins of public Pinterest profiles and boards
• YouTube Transcript Scraper — captions and subtitles as text + timed segments, per video or channel
• Google Search Results Scraper — SERP API — organic SERP results per keyword and country
• YouTube Comments Scraper — Comments & Replies — comments and replies with likes, no API key
• YouTube Channel Latest Videos (RSS, no API key) — the latest 15 videos of any channel from RSS
• YouTube Channel Scraper (videos, shorts, live) — a channel's full video, shorts and stream list
• YouTube Search Results Scraper (videos, channels, no API key) — videos, channels and playlists per query
• YouTube Video Details Scraper (views, likes, description, tags) — views, likes, description, tags and chapters per video
• Apple Podcasts Lookup & Episodes Scraper — podcast metadata and episodes from iTunes and RSS
• Bluesky Post, Search & Profile Scraper — posts, profiles, followers and threads from the AT Protocol API
• Telegram Channel Posts Scraper — posts, views and media flags from any public channel
• Substack Publication & Posts Scraper — archive, authors and paywall status per publication
• Google Play Reviews Scraper — reviews, ratings, replies and app versions per app
• App Store Reviews Scraper — iOS reviews and ratings per app and country
• Google Trends Scraper — interest over time, by region, and related queries per keyword
• Google Ads Transparency Scraper — ads any advertiser runs on Google, with format and dates
• Keyword Suggestions Scraper (Google, YouTube, Amazon, Bing) — autocomplete keyword ideas from four search engines
• Bilibili Scraper (Videos, Search, Popular) — Chinese video platform: views, likes, coins, danmaku, uploader
• Mastodon Scraper (Hashtags, Accounts, Trending) — public fediverse posts by hashtag, account or trending
• Meetup Events Scraper (Search by Keyword & City) — upcoming events with RSVPs, fees, venues and groups
• Eventbrite Scraper (Events by Keyword & City) — events by keyword and city with venue, dates and organizer

Leads, jobs and company data

• Career Site Jobs API (Greenhouse, Lever, Ashby, Workday +1) — company domains in, their open jobs out, ATS detected automatically
• Workday Jobs Scraper — jobs with full descriptions from any Workday career site
• Google Maps Scraper — businesses with phone, website, address, rating and coordinates per search
• LinkedIn Jobs Scraper — job titles, companies, locations and full descriptions from LinkedIn job search
• Company 360: full company profile from a domain — one row per domain: contacts, tech, security, hiring and company facts
• Hiring Signals Scraper (Greenhouse, Lever, Ashby, Workable) — open jobs and hiring velocity from 10 public ATS boards
• Y Combinator Companies & Founders Scraper — YC startups by batch, industry and hiring status
• Wikidata Entity & Company Enrichment (facts, IDs, links) — HQ, founders, employees, revenue and social IDs per company
• Email Validator & Verifier — Bulk Email Check — syntax, MX, disposable, role and free-provider checks
• OpenStreetMap POI Extractor (Overpass API: shops, amenities) — shops and amenities by radius, bbox or area
• Stock, Crypto & FX Quotes — one row per symbol from Yahoo, Binance and ECB rates
• Remote Jobs Aggregator (RemoteOK, WWR, Hacker News) — one clean row per remote job, de-duplicated across feeds
• Greenhouse Jobs Scraper — jobs with descriptions from any Greenhouse job board
• Lever Jobs Scraper — jobs with descriptions from any Lever careers page
• Ashby Jobs Scraper — jobs, salaries and descriptions from any Ashby job board
• SmartRecruiters Jobs Scraper — jobs with descriptions from any SmartRecruiters company
• Seek Jobs Scraper (Australia & New Zealand) — Seek job ads with salary, work type and location
• Dice Jobs Scraper — US tech jobs from Dice with salary and remote flag
• AutoScout24 Scraper — European car listings with price, mileage and seller
• Rightmove Scraper — UK property for sale or rent with price and agent
• Wellfound Jobs Scraper (AngelList Startup Jobs) — startup jobs with salary and equity ranges, company size and stage
• Yandex Maps Scraper (Places, Ratings, Phones) — businesses in Russia, Türkiye and the CIS with phones, ratings, hours
• Craigslist Scraper (Listings, Prices, Locations) — listings in any area and category with price, date and coordinates
• JobStreet Scraper (Malaysia, Singapore, PH, ID + JobsDB) — JobStreet and JobsDB jobs in 6 Asian countries with parsed salaries
• InfoJobs Scraper (Spain Jobs, Salaries, Companies) — Spanish jobs with salary range, contract type and full description
• Redfin Scraper (Homes for Sale, Prices, Details) — US homes for sale or sold from any Redfin search, with price and details
• Kleinanzeigen Scraper (Ads, Prices, Locations) — German classifieds with price, VB flag, ZIP, city and seller type

Developer, app and research data

• GitHub Repository Health & Activity Report — stars, commits, contributors and risk flags per repo
• VS Code Marketplace Extension Scraper (installs, ratings) — installs, ratings and versions per extension
• Chrome Web Store Extension Scraper (installs, ratings) — users, rating, version and developer per extension
• Google Play Scraper — apps, ratings, installs, developer contact and reviews
• App Store (iOS) App Metadata, Ratings & Top Charts Lookup — ratings, price, version and charts per app
• CrossRef DOI & Citation Metadata Lookup — papers, authors, journals and citation counts
• FDA Recalls & Adverse Events Monitor (openFDA) — food, drug and device recalls from openFDA
• iCal / ICS Calendar Feed to Events Extractor — any public calendar feed as event rows
• Shopify Store Products Scraper — catalog, prices, variants and stock per store
• Hacker News Search & Front Page Scraper — stories, comments and points by query or front page
• GitHub Trending Repositories Scraper — trending repos and developers by language and period
• Stack Overflow & Stack Exchange Q&A Scraper — questions, answers and scores by query, tag or site
• Bulk Image Downloader — download image URLs to storage with size, dimensions and a ZIP
• Google Flights Scraper (Prices, Airlines, Stops) — flight prices, airlines, times, stops and CO2 by route and date
• Google Hotels Scraper (Prices, Ratings, Reviews) — hotel prices per night, stars, rating and reviews by city and dates
• AliExpress Scraper (Search Products & Prices) — AliExpress search results with USD price, discount and rank
• Lazada Scraper (Products, Prices, Sold, Ratings) — Lazada products in 6 countries with price, rating, units sold and seller

Support and feedback

Missing a registry, a risk flag or a field? Open an issue on the Issues tab.