PyPI Scraper: Packages, Releases, Vulnerabilities & Downloads

Export Python package data from PyPI to JSON, CSV or Excel. Everything comes from PyPI's official JSON API, so there is no HTML parsing and no login.

One Actor, four jobs:

Mode	What you get
Package details	Version, summary, licence, author, repository, classifiers, supported Python versions, declared dependencies, development status, release count and download totals
Release history	Every version with its upload date, file count, total size, wheel and sdist availability, pre-release flag and yanked status with the maintainer's reason
Vulnerabilities	Known advisories for a package or a specific version, with aliases, affected details and the versions that fix them
Daily downloads	One row per day of download counts

Why use this one

• Yanked releases are flagged. PyPI lets maintainers withdraw a broken release without deleting it. Pip hides them, so they are invisible in most tooling, yet they are exactly what you want to find when auditing a lockfile. Every release here carries isYanked and yankedReason.
• Vulnerabilities per version. Point it at the exact version you have pinned and get the advisories that apply to it, including which releases fix them.
• Classifiers turned into usable fields. Supported Python versions, licence and development status are parsed out of PyPI's classifier strings into their own columns, instead of leaving you a list of 30 colon-separated strings.
• Built for bulk auditing. Paste a whole requirements.txt worth of names and get one row per package.

How to use it

1. Choose What to scrape.
2. Add Packages by project name or pypi.org link.
3. Click Start, then download the results or pull them through the Apify API.

Example input: audit a requirements file

{
  "mode": "packageDetails",
  "packages": ["requests", "django", "numpy", "pillow"],
  "includeDownloads": true
}

Example input: find yanked and pre-release versions

{
  "mode": "releases",
  "packages": ["requests"],
  "maxReleasesPerPackage": 200
}

Example input: check a pinned version for advisories

{
  "mode": "vulnerabilities",
  "packages": ["requests"],
  "version": "2.31.0"
}

Output

Each item carries a type field: package, release, vulnerability or downloads.

Package

{
  "type": "package",
  "registry": "pypi",
  "name": "requests",
  "version": "2.32.3",
  "summary": "Python HTTP for Humans.",
  "license": "Apache-2.0",
  "author": "Kenneth Reitz",
  "maintainer": "Ian Stapleton Cordasco, Nate Prewitt",
  "repositoryUrl": "https://github.com/psf/requests",
  "documentationUrl": "https://requests.readthedocs.io",
  "pythonVersions": ["3", "3.8", "3.9", "3.10", "3.11", "3.12"],
  "developmentStatus": "Production/Stable",
  "requiresPython": ">=3.8",
  "dependencyCount": 8,
  "releaseCount": 152,
  "vulnerabilityCount": 0,
  "isYanked": false,
  "downloadsLastMonth": 1202777296,
  "url": "https://pypi.org/project/requests/"
}

Release

{
  "type": "release",
  "name": "requests",
  "version": "2.31.0",
  "uploadedAt": "2023-05-22T15:12:42Z",
  "fileCount": 2,
  "totalSizeBytes": 171000,
  "hasWheel": true,
  "hasSdist": true,
  "isPrerelease": false,
  "isYanked": false,
  "url": "https://pypi.org/project/requests/2.31.0/"
}

Pricing

Pay only for results:

Result	Price
Package	$5.00 per 1,000
Release, vulnerability or download day	$1.00 per 1,000

Set a maximum spend per run in the run options and the Actor stops cleanly when it is reached.

Limits to know about

• There is no search mode, on purpose. PyPI retired its search API and has not replaced it. Scraping the website search page would break constantly, so this Actor does not pretend to offer it. Give it project names instead.
• Download counts come from pypistats.org, not from PyPI. PyPI publishes its download data only through Google BigQuery, and pypistats.org is the standard free republisher of it. If that service is slow or down, download fields come back empty and the rest of the run is unaffected. New or very small projects often have no series at all.
• Download counts are per project, not per version, and they count installs by machines including CI, not people.
• Vulnerability data comes from the Open Source Vulnerability database via PyPI. Absence of advisories is not proof a package is safe.
• Author and maintainer are names only by default. PyPI often stores them as Name <address> in the email fields; the Actor keeps the name and drops the address. Turn on Include author and maintainer emails to get authorEmails and maintainerEmails as well, if you have a lawful reason to process them.
• Vulnerability rows say which release was checked in version (the latest release unless you pin one), and list CVE numbers separately in cveIds.
• One row per vulnerability, not per database entry. PyPI lists most advisories twice, once from GitHub (GHSA) and once from the Python advisory database (PYSEC). The Actor merges the copies, so you see and pay for each vulnerability once; the other IDs are kept in aliases. vulnerabilityCount counts these merged, unwithdrawn advisories.

FAQ

Do I need a PyPI account? No. Everything here is public.

Can I check a whole lockfile? Yes. Paste every project name into Packages. Version pins are not read from the names, so use Vulnerabilities mode with the Version field for a specific pin.

Why is releaseCount empty? The project returned no release map, which normally means the name was wrong or the project was removed.

Can I run this on a schedule? Yes. Create a schedule in Apify Console and connect the dataset to Slack, Google Sheets, Zapier or Make to get alerted when a new advisory appears.

Feedback

Found a bug or need a field that is missing? Open an issue on the Actor's Issues tab.