# npm & PyPI Package Scraper: Downloads, Stars, Vulnerabilities (`wintersworks/npm-pypi-package-intelligence`) Actor

Input: npm or PyPI package names. Output: package metadata, download counts, GitHub stars, known vulnerabilities and maintenance-health signals per package. $1 per 1,000 packages.

- **URL**: https://apify.com/wintersworks/npm-pypi-package-intelligence.md
- **Developed by:** [Winters Works](https://apify.com/wintersworks) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$1.00 / 1,000 package results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## npm & PyPI Package Scraper: Downloads, Stars, Vulnerabilities

Get clean, flat metadata for **npm** and **PyPI** packages in one run: latest version, license, maintainers, release history, weekly and monthly downloads, dependency count, GitHub stars, known vulnerabilities and a simple health rating. Everything comes from official public APIs. No scraping, no login, no proxies.

### What you get per package

| Field | Notes |
|---|---|
| ecosystem, name, latestVersion, url | npm or pypi |
| description, license, homepage, repoUrl | repo URL normalized |
| author, maintainers, keywords | |
| createdAt, lastPublishedAt, versionsCount | PyPI created date = first upload |
| weeklyDownloads, monthlyDownloads | optional |
| dependenciesCount | runtime dependencies of the latest version |
| githubStars, githubOpenIssues, githubLastCommit | optional |
| vulnCount, vulnIds | optional, known vulnerabilities in the latest version (OSV.dev) |
| deprecated, deprecatedMessage | |
| daysSinceLastRelease, health | active / slowing / stale / abandoned / deprecated |

Health thresholds: active up to 180 days since last release, slowing up to 18 months, stale up to 3 years, abandoned beyond that.

### Use cases

- **Dev-tool marketing**: find popular packages and their maintainers in your niche (use npm search, e.g. `keywords:mcp`).
- **Supply-chain security**: audit a dependency list for abandoned, deprecated or vulnerable packages.
- **OSS analysis and due diligence**: compare adoption, release cadence and GitHub traction across projects.
- **Investors and researchers**: track growth of developer tools by downloads and stars.

### Example input

```json
{
  "ecosystem": "both",
  "packages": ["react", "requests", "@types/node"],
  "includeDownloads": true,
  "includeGithub": false,
  "includeVulns": true
}
```

Search npm instead:

```json
{ "ecosystem": "npm", "packages": [], "searchQuery": "keywords:web-scraping", "maxResults": 50 }
```

### Example output

```json
{
  "ecosystem": "pypi", "name": "requests", "latestVersion": "2.32.3",
  "license": "Apache-2.0", "weeklyDownloads": 60000000,
  "dependenciesCount": 4, "vulnCount": 0, "daysSinceLastRelease": 120, "health": "active"
}
```

### Pricing

Pay per result: about **$1 per 1,000 packages** (one `package-result` event per record). Set a maximum spend per run and the Actor stops cleanly when it is reached.

### FAQ

**Does it need API keys?** No. A GitHub token is optional and only raises the GitHub rate limit from 60 to 5,000 requests per hour. Without it, enable GitHub stats only for small lists.

**Can I search PyPI?** PyPI has no official search API, so search works on npm only. For PyPI, provide package names.

**With ecosystem "both", what happens to a name that exists on only one registry?** It is looked up on both and missing ones are skipped.

**How fresh is the data?** Live at run time. PyPI download numbers come from pypistats.org, which updates daily; requests to it are throttled to about one per second.

**Are vulnerabilities complete?** They come from OSV.dev for the latest version only. Treat it as a screening signal, not a full audit.

### Data sources

registry.npmjs.org (metadata and search), api.npmjs.org (downloads), pypi.org JSON API, pypistats.org, api.github.com (optional), api.osv.dev (optional).

By Winters Works.

### Is it legal? (public data only)

Yes, in the sense that it only reads public or official data: the public npm, PyPI, OSV.dev and (optionally) GitHub APIs. It does not log in, bypass paywalls or access private data. You remain responsible for how you use the results, including privacy, copyright and marketing laws. Not affiliated with or endorsed by the data sources.

### Quick start and cost

Run it with the prefilled input to see sample output in seconds; the default run costs only a few cents at most. Then adjust the input and schedule it.

### Use from code and AI agents

Call it from any language with the Apify API, or let an AI agent find and run it through the [Apify MCP server](https://mcp.apify.com).

```python
from apify_client import ApifyClient
run = ApifyClient("<YOUR_APIFY_TOKEN>").actor("wintersworks/npm-pypi-package-intelligence").call(run_input={"ecosystem": "both", "packages": ["react", "requests"]})
items = ApifyClient("<YOUR_APIFY_TOKEN>").dataset(run["defaultDatasetId"]).list_items().items
```

Results land in the run's dataset (JSON, CSV, Excel). Set a maximum charge per run in the run options to cap spend.

### About

Built and maintained by Winters Works. Questions or feature requests: open an issue on the Actor page or email wintersworks.shop@gmail.com.

# Actor input Schema

## `ecosystem` (type: `string`):

Which registry to query. For a search query, only npm is searched (PyPI has no official search API).

## `packages` (type: `array`):

Package names, e.g. react, @types/node, requests. With 'both', each name is looked up on npm and PyPI.

## `searchQuery` (type: `string`):

Optional. Searches npm (e.g. 'keywords:mcp' or 'web scraping') and adds the results to the package list.

## `maxResults` (type: `integer`):

Maximum packages to take from the search query.

## `includeDownloads` (type: `boolean`):

Weekly and monthly downloads (npm downloads API, pypistats.org).

## `includeGithub` (type: `boolean`):

Stars, open issues and last push date. Unauthenticated GitHub allows only 60 requests/hour; add a token for more.

## `githubToken` (type: `string`):

Personal access token with no scopes needed. Raises the GitHub limit to 5,000/hour.

## `includeVulns` (type: `boolean`):

Looks up the latest version on OSV.dev.

## Actor input object example

```json
{
  "ecosystem": "both",
  "packages": [
    "react",
    "requests"
  ],
  "maxResults": 20,
  "includeDownloads": true,
  "includeGithub": false,
  "includeVulns": false
}
```

# Actor output Schema

## `results` (type: `string`):

All result items from the run's default dataset.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "react",
        "requests"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("wintersworks/npm-pypi-package-intelligence").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packages": [
        "react",
        "requests",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("wintersworks/npm-pypi-package-intelligence").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "react",
    "requests"
  ]
}' |
apify call wintersworks/npm-pypi-package-intelligence --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,wintersworks/npm-pypi-package-intelligence"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/P8Y8DIqRhkX1PgBgn/builds/SGtG5cSt0kVmZisn9/openapi.json