# npm, PyPI & Crates.io Package Health Checker (`webdatatools/package-health-checker`) Actor

Package health checker for npm, PyPI and Crates.io — deprecation, last publish date, licence, weekly downloads, maintainers, GitHub stars and a 0-100 health score, one row per package.

- **URL**: https://apify.com/webdatatools/package-health-checker.md
- **Developed by:** [Murat Uzun](https://apify.com/webdatatools) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.20 / 1,000 results

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

### What is npm, PyPI & Crates.io Package Health Checker?

npm, PyPI & Crates.io Package Health Checker is an Apify Actor that answers the question every dependency review starts with: **is this package still alive?** Give it a list of packages — `npm:react`, `pypi:requests`, `crates:serde` — and it returns **one clean row per package** with the deprecation status, last publish date, release cadence, licence, weekly downloads, maintainer count, GitHub stars and archive flag, plus a 0-100 health score and an A-F grade.

It reads the official public registry APIs (registry.npmjs.org, pypi.org, crates.io) and the GitHub REST API. No API key, no proxy, no browser, no anti-bot handling — so a 1,000-package lock file costs a few cents of compute and finishes in minutes.

### What data does Package Health Checker extract?

Package Health Checker extracts the maintenance and licence signals that decide whether a dependency is safe to keep:

| Field | Type | Description |
|---|---|---|
| `package` | string | The reference you entered, e.g. `npm:react` |
| `registry` | string | `npm`, `pypi` or `crates` |
| `name` / `description` | string | Canonical name and one-line description |
| `latestVersion` | string | Latest published version |
| `latestPublishedAt` | string | ISO date of the latest release |
| `daysSinceLastPublish` | number | Staleness in days |
| `firstPublishedAt` / `packageAgeDays` | string/number | First release, age in days |
| `versionCount` | number | Total published versions |
| `releasesLast12Months` | number | Releases in the trailing 365 days |
| `license` | string | Licence identifier, e.g. `MIT`, `MIT OR Apache-2.0` |
| `isDeprecated` | boolean | npm deprecation, or a yanked PyPI/crates.io release |
| `deprecationMessage` | string | The maintainer's deprecation note |
| `weeklyDownloads` | number | Weekly download volume |
| `maintainerCount` | number | npm maintainers (null on PyPI and crates.io) |
| `homepage` / `repositoryUrl` | string | Project and source URLs |
| `github` | object | `stars`, `forks`, `openIssues`, `archived`, `lastPushAt`, `license` |
| `riskFlags` | array | `deprecated`, `no-license`, `stale-18-months`, `stale-36-months`, `archived-repo`, `single-maintainer`, `low-downloads`, `no-repository` |
| `healthScore` / `healthGrade` | number/string | 0-100 and A-F |
| `error` / `githubError` / `scrapedAt` | string | Per-row failure reasons and timestamp |

### How to use Package Health Checker

1. Paste your packages into **Packages**, one per row, prefixed with the registry: `npm:react`, `pypi:requests`, `crates:serde`. Bare names such as `react` or `@scope/name` use **Default registry**; full registry URLs work too.
2. Leave **Enrich with GitHub data** on for stars, forks and the archived flag. For lists longer than ~50 packages, paste a **GitHub token** — anonymous GitHub calls are capped at 60 per hour.
3. Click **Start**, then download the results as JSON, CSV, Excel or HTML, or pull them from the dataset API.

### Example input

```json
{
  "packages": ["npm:react", "npm:request", "pypi:requests", "crates:serde", "npm:left-pad"],
  "defaultRegistry": "npm",
  "enrichGithub": true,
  "maxConcurrency": 5
}
```

### Example output

```json
{
  "package": "npm:left-pad",
  "registry": "npm",
  "name": "left-pad",
  "latestVersion": "1.3.0",
  "latestPublishedAt": "2018-04-09T01:10:45.796Z",
  "daysSinceLastPublish": 3078,
  "releasesLast12Months": 0,
  "license": "WTFPL",
  "isDeprecated": true,
  "deprecationMessage": "use String.prototype.padStart()",
  "weeklyDownloads": 1154291,
  "maintainerCount": 2,
  "repositoryUrl": "https://github.com/stevemao/left-pad",
  "github": { "stars": 1303, "forks": 139, "openIssues": 10, "archived": true, "lastPushAt": "2019-04-19T14:16:20.000Z" },
  "riskFlags": ["deprecated", "stale-36-months", "archived-repo"],
  "healthScore": 0,
  "healthGrade": "F",
  "scrapedAt": "2026-09-12T15:48:10.000Z"
}
```

### Input parameters

| Parameter | Type | Default | Description |
|---|---|---|---|
| `packages` | array | `["react"]` | Packages to check, one row each |
| `defaultRegistry` | string | `npm` | Registry for bare names (`npm`, `pypi`, `crates`) |
| `enrichGithub` | boolean | true | Add GitHub stars, forks, issues, archived flag |
| `githubToken` | string (secret) | none | Raises the GitHub limit from 60 to 5,000 requests/hour |
| `maxConcurrency` | integer | 5 | Parallel lookups (1-20) |

### Pricing

Package Health Checker uses pay-per-event pricing: **$0.002 per package row** ($2 per 1,000 packages), plus a negligible $0.00005 actor-start fee, with platform usage included. A 500-dependency audit therefore costs about $1. Set **Maximum cost per run** to cap spend — the Actor trims the list to what the budget covers instead of overrunning it.

### Package Health Checker vs. Snyk Advisor and Socket

Snyk Advisor and Socket give you one beautifully rendered page per package, in a browser, one at a time. Package Health Checker gives you 500 packages as a spreadsheet in one run, on demand or on a schedule, with the same underlying registry facts and a score you can sort and filter. It is complementary rather than competing: this Actor covers maintenance, licence and popularity risk, not CVE matching or malware behaviour analysis — pair it with an advisory database such as OSV or GitHub Advisories for vulnerability data.

### Using Package Health Checker with AI agents and MCP

Package Health Checker runs on pay-per-event pricing with limited permissions — the two requirements for an Actor to be callable through the Apify MCP server at mcp.apify.com. An agent reviewing a `package.json`, `requirements.txt` or `Cargo.toml` passes the dependency names as `packages` and gets back a scored row per dependency, ready to summarise. It also connects through n8n, Make, Zapier and LangChain via Apify's integrations.

### FAQ

**How is the health score calculated?** Every package starts at 100 and loses points per risk flag: deprecated -50, archived repository -40, no release in 36 months -30 (18 months -15), no licence -15, no repository -10, fewer than 100 weekly downloads -10, a single npm maintainer -5. The score floors at 0. Grades: A >= 85, B >= 70, C >= 50, D >= 30, otherwise F.

**Where do the download numbers come from?** npm's own `api.npmjs.org` last-week endpoint, pypistats.org for PyPI, and crates.io's trailing-90-day figure divided by 13 for Rust crates. pypistats.org rate-limits aggressively; when it answers 429 the row keeps `weeklyDownloads: null` instead of failing.

**Why is `maintainerCount` empty for Python and Rust packages?** Only npm publishes the maintainer list in its public metadata. PyPI and crates.io do not, so the field is null and the `single-maintainer` flag never fires for them.

**Does it detect vulnerabilities or CVEs?** No. It measures maintenance, licence and popularity risk. Use it alongside a vulnerability scanner.

**Does a package that is missing fail the whole run?** No. A typo, a private package or an unsupported registry produces a row with `error` filled in and the other columns null, so you can see exactly which entries need attention.

**Is this legal to run?** Yes — it reads public registry metadata through official APIs and collects no personal data beyond the maintainer usernames npm already publishes.

**Can I export to CSV or push results into my own tools?** Yes. Download JSON, CSV, Excel or HTML from the Output tab, hit the dataset API, or wire the run into n8n, Make, Zapier, Slack or Google Sheets through Apify's integrations.

### Related Actors

Part of the **webdatatools** web-intelligence suite — every Actor is pay-per-event, runs without
proxies or a headless browser, and returns one clean row per entity:

**Website & domain intelligence**

- [Website Contact & Social Extractor](https://apify.com/webdatatools/contact-extractor) — e-mails, phones and social profiles per domain
- [Website Tech Stack Detector](https://apify.com/webdatatools/tech-stack-detector) — CMS, e-commerce, analytics, pixels and payments per domain
- [Domain DNS & Email Security Checker](https://apify.com/webdatatools/dns-email-security-checker) — SPF, DKIM, DMARC, MX provider, registrar and domain age
- [Domain Security Audit](https://apify.com/webdatatools/domain-security-audit) — TLS expiry, security headers, redirect chain, robots and llms.txt
- [Subdomain Finder (Certificate Transparency)](https://apify.com/webdatatools/subdomain-finder) — every subdomain seen in CT logs, with a live DNS check
- [Bulk Core Web Vitals & PageSpeed Audit](https://apify.com/webdatatools/core-web-vitals-audit) — Lighthouse scores, LCP, CLS, INP and top fixes per URL
- [On-Page SEO Audit](https://apify.com/webdatatools/seo-page-audit) — title, meta, headings, links, images and schema issues per page
- [Sitemap URL Extractor & Change Monitor](https://apify.com/webdatatools/sitemap-extractor) — every sitemap URL, or new and removed pages between runs
- [Wayback Machine Snapshot & Page Change Tracker](https://apify.com/webdatatools/wayback-page-diff) — how a page changed over time, or every archived snapshot

**Content for AI, LLMs and RAG**

- [AI Web Search & Read](https://apify.com/webdatatools/ai-web-search) — a query turned into clean Markdown from the top search results
- [Website to Markdown Crawler for LLM & RAG](https://apify.com/webdatatools/website-to-markdown) — any site as clean Markdown per page, no browser
- [Article & News Extractor](https://apify.com/webdatatools/article-extractor) — clean article text, author, date and Markdown per URL
- [Structured Data & JSON-LD Extractor](https://apify.com/webdatatools/structured-data-extractor) — Schema.org and Open Graph data from any page
- [Google News Scraper](https://apify.com/webdatatools/google-news-scraper) — news results by keyword, topic or site
- [Press Release Monitor](https://apify.com/webdatatools/press-release-monitor) — PR Newswire, Business Wire and GlobeNewswire releases

**Search, video and social**

- [Google Search Results Scraper](https://apify.com/webdatatools/google-search-scraper) — organic SERP results per keyword and country
- [YouTube Comments Scraper](https://apify.com/webdatatools/youtube-comments-scraper) — comments and replies with likes, no API key
- [YouTube Channel Latest Videos](https://apify.com/webdatatools/youtube-channel-videos) — the latest 15 videos of any channel from RSS
- [YouTube Channel Videos Scraper](https://apify.com/webdatatools/youtube-channel-scraper) — a channel's full video, shorts and stream list
- [YouTube Search Results Scraper](https://apify.com/webdatatools/youtube-search-scraper) — videos, channels and playlists per query
- [YouTube Video Details Scraper](https://apify.com/webdatatools/youtube-video-details) — views, likes, description, tags and chapters per video
- [Apple Podcasts Lookup & Episodes Scraper](https://apify.com/webdatatools/podcast-lookup) — podcast metadata and episodes from iTunes and RSS
- [Bluesky Scraper](https://apify.com/webdatatools/bluesky-scraper) — posts, profiles, followers and threads from the AT Protocol API

**Leads, jobs and company data**

- [Company 360](https://apify.com/webdatatools/company-360) — one row per domain: contacts, tech, security, hiring and company facts
- [Hiring Signals Scraper](https://apify.com/webdatatools/hiring-signals) — open jobs and hiring velocity from 10 public ATS boards
- [Y Combinator Companies & Founders Scraper](https://apify.com/webdatatools/yc-companies-scraper) — YC startups by batch, industry and hiring status
- [Wikidata Entity & Company Enrichment](https://apify.com/webdatatools/wikidata-entity-enrichment) — HQ, founders, employees, revenue and social IDs per company
- [Bulk Email Validator](https://apify.com/webdatatools/email-validator) — syntax, MX, disposable, role and free-provider checks
- [OpenStreetMap POI Extractor](https://apify.com/webdatatools/overpass-poi-extractor) — shops and amenities by radius, bbox or area

**Developer, app and research data**

- [GitHub Repository Health & Activity Report](https://apify.com/webdatatools/github-repo-health) — stars, commits, contributors and risk flags per repo
- [VS Code Marketplace Extension Scraper](https://apify.com/webdatatools/vscode-marketplace-extensions) — installs, ratings and versions per extension
- [Chrome Web Store Extension Scraper](https://apify.com/webdatatools/chrome-web-store-extensions) — users, rating, version and developer per extension
- [Google Play Store Scraper](https://apify.com/webdatatools/google-play-scraper) — apps, ratings, installs, developer contact and reviews
- [App Store (iOS) App Metadata & Top Charts](https://apify.com/webdatatools/app-store-lookup) — ratings, price, version and charts per app
- [CrossRef DOI & Citation Metadata Lookup](https://apify.com/webdatatools/crossref-doi-lookup) — papers, authors, journals and citation counts
- [FDA Recalls & Adverse Events Monitor](https://apify.com/webdatatools/openfda-recall-monitor) — food, drug and device recalls from openFDA
- [iCal / ICS Calendar Feed to Events Extractor](https://apify.com/webdatatools/ical-calendar-extractor) — any public calendar feed as event rows
- [Shopify Store Products Scraper](https://apify.com/webdatatools/shopify-products-scraper) — catalog, prices, variants and stock per store

### Support and feedback

Missing a registry, a risk flag or a field? Open an issue on the **Issues** tab.

# Actor input Schema

## `packages` (type: `array`):

Enter the packages to check, one row is returned per package. Prefix the name with the registry, e.g. npm:react, pypi:requests, crates:serde. Bare names such as react or @scope/name use the default registry below, and full registry URLs work too, e.g. https://pypi.org/project/requests/.

## `defaultRegistry` (type: `string`):

Select which registry a bare package name belongs to, e.g. npm for react. Entries that already carry a prefix (pypi:requests) or a registry URL ignore this setting.

## `enrichGithub` (type: `boolean`):

Keep this on to add GitHub stars, forks, open issues, the archived flag and the last push date whenever the package points at a GitHub repository. Turn it off to run faster and avoid GitHub rate limits.

## `githubToken` (type: `string`):

Optional. Paste a GitHub personal access token (https://github.com/settings/tokens, no scopes needed for public repos) to raise the GitHub API limit from 60 to 5,000 requests per hour. Without a token, long lists come back with githubError: "rate limited".

## `maxConcurrency` (type: `integer`):

Enter how many packages to look up in parallel, e.g. 5. Lower it to 1-2 if PyPI download stats start returning 429 rate-limit responses.

## Actor input object example

```json
{
  "packages": [
    "npm:react",
    "pypi:requests",
    "crates:serde"
  ],
  "defaultRegistry": "npm",
  "enrichGithub": true,
  "maxConcurrency": 5
}
```

# Actor output Schema

## `packages` (type: `string`):

All checked packages — download as JSON, CSV, Excel or HTML.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "npm:react",
        "pypi:requests",
        "crates:serde"
    ],
    "defaultRegistry": "npm",
    "enrichGithub": true,
    "maxConcurrency": 5
};

// Run the Actor and wait for it to finish
const run = await client.actor("webdatatools/package-health-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "packages": [
        "npm:react",
        "pypi:requests",
        "crates:serde",
    ],
    "defaultRegistry": "npm",
    "enrichGithub": True,
    "maxConcurrency": 5,
}

# Run the Actor and wait for it to finish
run = client.actor("webdatatools/package-health-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "npm:react",
    "pypi:requests",
    "crates:serde"
  ],
  "defaultRegistry": "npm",
  "enrichGithub": true,
  "maxConcurrency": 5
}' |
apify call webdatatools/package-health-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,webdatatools/package-health-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/TdSenN5Wsa4BXLhxv/builds/dM1QoWoUoE0vbStT9/openapi.json