npm, PyPI & Crates.io Package Health Checker

What is npm, PyPI & Crates.io Package Health Checker?

npm, PyPI & Crates.io Package Health Checker is an Apify Actor that answers the question every dependency review starts with: is this package still alive? Give it a list of packages — npm:react, pypi:requests, crates:serde — and it returns one clean row per package with the deprecation status, last publish date, release cadence, licence, weekly downloads, maintainer count, GitHub stars and archive flag, plus a 0-100 health score and an A-F grade.

It reads the official public registry APIs (registry.npmjs.org, pypi.org, crates.io) and the GitHub REST API. No API key, no proxy, no browser, no anti-bot handling — so a 1,000-package lock file costs a few cents of compute and finishes in minutes.

What data does Package Health Checker extract?

Package Health Checker extracts the maintenance and licence signals that decide whether a dependency is safe to keep:

Field	Type	Description
package	string	The reference you entered, e.g. npm:react
registry	string	npm, pypi or crates
name / description	string	Canonical name and one-line description
latestVersion	string	Latest published version
latestPublishedAt	string	ISO date of the latest release
daysSinceLastPublish	number	Staleness in days
firstPublishedAt / packageAgeDays	string/number	First release, age in days
versionCount	number	Total published versions
releasesLast12Months	number	Releases in the trailing 365 days
license	string	Licence identifier, e.g. MIT, MIT OR Apache-2.0
isDeprecated	boolean	npm deprecation, or a yanked PyPI/crates.io release
deprecationMessage	string	The maintainer's deprecation note
weeklyDownloads	number	Weekly download volume
maintainerCount	number	npm maintainers (null on PyPI and crates.io)
homepage / repositoryUrl	string	Project and source URLs
github	object	stars, forks, openIssues, archived, lastPushAt, license
riskFlags	array	deprecated, no-license, stale-18-months, stale-36-months, archived-repo, single-maintainer, low-downloads, no-repository
healthScore / healthGrade	number/string	0-100 and A-F
error / githubError / scrapedAt	string	Per-row failure reasons and timestamp

How to use Package Health Checker

1. Paste your packages into Packages, one per row, prefixed with the registry: npm:react, pypi:requests, crates:serde. Bare names such as react or @scope/name use Default registry; full registry URLs work too.
2. Leave Enrich with GitHub data on for stars, forks and the archived flag. For lists longer than ~50 packages, paste a GitHub token — anonymous GitHub calls are capped at 60 per hour.
3. Click Start, then download the results as JSON, CSV, Excel or HTML, or pull them from the dataset API.

Example input

{
  "packages": ["npm:react", "npm:request", "pypi:requests", "crates:serde", "npm:left-pad"],
  "defaultRegistry": "npm",
  "enrichGithub": true,
  "maxConcurrency": 5
}

Example output

{
  "package": "npm:left-pad",
  "registry": "npm",
  "name": "left-pad",
  "latestVersion": "1.3.0",
  "latestPublishedAt": "2018-04-09T01:10:45.796Z",
  "daysSinceLastPublish": 3078,
  "releasesLast12Months": 0,
  "license": "WTFPL",
  "isDeprecated": true,
  "deprecationMessage": "use String.prototype.padStart()",
  "weeklyDownloads": 1154291,
  "maintainerCount": 2,
  "repositoryUrl": "https://github.com/stevemao/left-pad",
  "github": { "stars": 1303, "forks": 139, "openIssues": 10, "archived": true, "lastPushAt": "2019-04-19T14:16:20.000Z" },
  "riskFlags": ["deprecated", "stale-36-months", "archived-repo"],
  "healthScore": 0,
  "healthGrade": "F",
  "scrapedAt": "2026-09-12T15:48:10.000Z"
}

Input parameters

Parameter	Type	Default	Description
packages	array	["react"]	Packages to check, one row each
defaultRegistry	string	npm	Registry for bare names (npm, pypi, crates)
enrichGithub	boolean	true	Add GitHub stars, forks, issues, archived flag
githubToken	string (secret)	none	Raises the GitHub limit from 60 to 5,000 requests/hour
maxConcurrency	integer	5	Parallel lookups (1-20)

Pricing

Package Health Checker uses pay-per-event pricing: $0.002 per package row ($2 per 1,000 packages), plus a negligible $0.00005 actor-start fee, with platform usage included. A 500-dependency audit therefore costs about $1. Set Maximum cost per run to cap spend — the Actor trims the list to what the budget covers instead of overrunning it.

Package Health Checker vs. Snyk Advisor and Socket

Snyk Advisor and Socket give you one beautifully rendered page per package, in a browser, one at a time. Package Health Checker gives you 500 packages as a spreadsheet in one run, on demand or on a schedule, with the same underlying registry facts and a score you can sort and filter. It is complementary rather than competing: this Actor covers maintenance, licence and popularity risk, not CVE matching or malware behaviour analysis — pair it with an advisory database such as OSV or GitHub Advisories for vulnerability data.

Using Package Health Checker with AI agents and MCP

Package Health Checker runs on pay-per-event pricing with limited permissions — the two requirements for an Actor to be callable through the Apify MCP server at mcp.apify.com. An agent reviewing a package.json, requirements.txt or Cargo.toml passes the dependency names as packages and gets back a scored row per dependency, ready to summarise. It also connects through n8n, Make, Zapier and LangChain via Apify's integrations.

FAQ

How is the health score calculated? Every package starts at 100 and loses points per risk flag: deprecated -50, archived repository -40, no release in 36 months -30 (18 months -15), no licence -15, no repository -10, fewer than 100 weekly downloads -10, a single npm maintainer -5. The score floors at 0. Grades: A >= 85, B >= 70, C >= 50, D >= 30, otherwise F.

Where do the download numbers come from? npm's own api.npmjs.org last-week endpoint, pypistats.org for PyPI, and crates.io's trailing-90-day figure divided by 13 for Rust crates. pypistats.org rate-limits aggressively; when it answers 429 the row keeps weeklyDownloads: null instead of failing.

Why is maintainerCount empty for Python and Rust packages? Only npm publishes the maintainer list in its public metadata. PyPI and crates.io do not, so the field is null and the single-maintainer flag never fires for them.

Does it detect vulnerabilities or CVEs? No. It measures maintenance, licence and popularity risk. Use it alongside a vulnerability scanner.

Does a package that is missing fail the whole run? No. A typo, a private package or an unsupported registry produces a row with error filled in and the other columns null, so you can see exactly which entries need attention.

Is this legal to run? Yes — it reads public registry metadata through official APIs and collects no personal data beyond the maintainer usernames npm already publishes.

Can I export to CSV or push results into my own tools? Yes. Download JSON, CSV, Excel or HTML from the Output tab, hit the dataset API, or wire the run into n8n, Make, Zapier, Slack or Google Sheets through Apify's integrations.

Related Actors

Part of the webdatatools web-intelligence suite — every Actor is pay-per-event, runs without proxies or a headless browser, and returns one clean row per entity:

Website & domain intelligence

• Website Contact & Social Extractor — e-mails, phones and social profiles per domain
• Website Tech Stack Detector — CMS, e-commerce, analytics, pixels and payments per domain
• Domain DNS & Email Security Checker — SPF, DKIM, DMARC, MX provider, registrar and domain age
• Domain Security Audit — TLS expiry, security headers, redirect chain, robots and llms.txt
• Subdomain Finder (Certificate Transparency) — every subdomain seen in CT logs, with a live DNS check
• Bulk Core Web Vitals & PageSpeed Audit — Lighthouse scores, LCP, CLS, INP and top fixes per URL
• On-Page SEO Audit — title, meta, headings, links, images and schema issues per page
• Sitemap URL Extractor & Change Monitor — every sitemap URL, or new and removed pages between runs
• Wayback Machine Snapshot & Page Change Tracker — how a page changed over time, or every archived snapshot

Content for AI, LLMs and RAG

• AI Web Search & Read — a query turned into clean Markdown from the top search results
• Website to Markdown Crawler for LLM & RAG — any site as clean Markdown per page, no browser
• Article & News Extractor — clean article text, author, date and Markdown per URL
• Structured Data & JSON-LD Extractor — Schema.org and Open Graph data from any page
• Google News Scraper — news results by keyword, topic or site
• Press Release Monitor — PR Newswire, Business Wire and GlobeNewswire releases

Search, video and social

• Google Search Results Scraper — organic SERP results per keyword and country
• YouTube Comments Scraper — comments and replies with likes, no API key
• YouTube Channel Latest Videos — the latest 15 videos of any channel from RSS
• YouTube Channel Videos Scraper — a channel's full video, shorts and stream list
• YouTube Search Results Scraper — videos, channels and playlists per query
• YouTube Video Details Scraper — views, likes, description, tags and chapters per video
• Apple Podcasts Lookup & Episodes Scraper — podcast metadata and episodes from iTunes and RSS
• Bluesky Scraper — posts, profiles, followers and threads from the AT Protocol API

Leads, jobs and company data

• Company 360 — one row per domain: contacts, tech, security, hiring and company facts
• Hiring Signals Scraper — open jobs and hiring velocity from 10 public ATS boards
• Y Combinator Companies & Founders Scraper — YC startups by batch, industry and hiring status
• Wikidata Entity & Company Enrichment — HQ, founders, employees, revenue and social IDs per company
• Bulk Email Validator — syntax, MX, disposable, role and free-provider checks
• OpenStreetMap POI Extractor — shops and amenities by radius, bbox or area

Developer, app and research data

• GitHub Repository Health & Activity Report — stars, commits, contributors and risk flags per repo
• VS Code Marketplace Extension Scraper — installs, ratings and versions per extension
• Chrome Web Store Extension Scraper — users, rating, version and developer per extension
• Google Play Store Scraper — apps, ratings, installs, developer contact and reviews
• App Store (iOS) App Metadata & Top Charts — ratings, price, version and charts per app
• CrossRef DOI & Citation Metadata Lookup — papers, authors, journals and citation counts
• FDA Recalls & Adverse Events Monitor — food, drug and device recalls from openFDA
• iCal / ICS Calendar Feed to Events Extractor — any public calendar feed as event rows
• Shopify Store Products Scraper — catalog, prices, variants and stock per store

Support and feedback

Missing a registry, a risk flag or a field? Open an issue on the Issues tab.