npm & PyPI Package Scraper: Downloads, Stars, Vulnerabilities

Get clean, flat metadata for npm and PyPI packages in one run: latest version, license, maintainers, release history, weekly and monthly downloads, dependency count, GitHub stars, known vulnerabilities and a simple health rating. Everything comes from official public APIs. No scraping, no login, no proxies.

What you get per package

Field	Notes
ecosystem, name, latestVersion, url	npm or pypi
description, license, homepage, repoUrl	repo URL normalized
author, maintainers, keywords
createdAt, lastPublishedAt, versionsCount	PyPI created date = first upload
weeklyDownloads, monthlyDownloads	optional
dependenciesCount	runtime dependencies of the latest version
githubStars, githubOpenIssues, githubLastCommit	optional
vulnCount, vulnIds	optional, known vulnerabilities in the latest version (OSV.dev)
deprecated, deprecatedMessage
daysSinceLastRelease, health	active / slowing / stale / abandoned / deprecated

Health thresholds: active up to 180 days since last release, slowing up to 18 months, stale up to 3 years, abandoned beyond that.

Use cases

• Dev-tool marketing: find popular packages and their maintainers in your niche (use npm search, e.g. keywords:mcp).
• Supply-chain security: audit a dependency list for abandoned, deprecated or vulnerable packages.
• OSS analysis and due diligence: compare adoption, release cadence and GitHub traction across projects.
• Investors and researchers: track growth of developer tools by downloads and stars.

Example input

{
  "ecosystem": "both",
  "packages": ["react", "requests", "@types/node"],
  "includeDownloads": true,
  "includeGithub": false,
  "includeVulns": true
}

Search npm instead:

{ "ecosystem": "npm", "packages": [], "searchQuery": "keywords:web-scraping", "maxResults": 50 }

Example output

{
  "ecosystem": "pypi", "name": "requests", "latestVersion": "2.32.3",
  "license": "Apache-2.0", "weeklyDownloads": 60000000,
  "dependenciesCount": 4, "vulnCount": 0, "daysSinceLastRelease": 120, "health": "active"
}

Pricing

Pay per result: about $1 per 1,000 packages (one package-result event per record). Set a maximum spend per run and the Actor stops cleanly when it is reached.

FAQ

Does it need API keys? No. A GitHub token is optional and only raises the GitHub rate limit from 60 to 5,000 requests per hour. Without it, enable GitHub stats only for small lists.

Can I search PyPI? PyPI has no official search API, so search works on npm only. For PyPI, provide package names.

With ecosystem "both", what happens to a name that exists on only one registry? It is looked up on both and missing ones are skipped.

How fresh is the data? Live at run time. PyPI download numbers come from pypistats.org, which updates daily; requests to it are throttled to about one per second.

Are vulnerabilities complete? They come from OSV.dev for the latest version only. Treat it as a screening signal, not a full audit.

Data sources

registry.npmjs.org (metadata and search), api.npmjs.org (downloads), pypi.org JSON API, pypistats.org, api.github.com (optional), api.osv.dev (optional).

By Winters Works.

Is it legal? (public data only)

Yes, in the sense that it only reads public or official data: the public npm, PyPI, OSV.dev and (optionally) GitHub APIs. It does not log in, bypass paywalls or access private data. You remain responsible for how you use the results, including privacy, copyright and marketing laws. Not affiliated with or endorsed by the data sources.

Quick start and cost

Run it with the prefilled input to see sample output in seconds; the default run costs only a few cents at most. Then adjust the input and schedule it.

Use from code and AI agents

Call it from any language with the Apify API, or let an AI agent find and run it through the Apify MCP server.

from apify_client import ApifyClient
run = ApifyClient("<YOUR_APIFY_TOKEN>").actor("wintersworks/npm-pypi-package-intelligence").call(run_input={"ecosystem": "both", "packages": ["react", "requests"]})
items = ApifyClient("<YOUR_APIFY_TOKEN>").dataset(run["defaultDatasetId"]).list_items().items

Results land in the run's dataset (JSON, CSV, Excel). Set a maximum charge per run in the run options to cap spend.

About

Built and maintained by Winters Works. Questions or feature requests: open an issue on the Actor page or email wintersworks.shop@gmail.com.