npm Package Intel — downloads, dependents, maintenance health, registry search

One clean JSON per npm package: latest version and dist-tags, weekly/monthly/yearly downloads, daily download series, number of dependents, publish cadence (releases in the last 90/365 days, days since last publish), deprecation status, license, repository, TypeScript/ESM/provenance flags, dependency counts and maps, package size — plus a registry search mode to discover packages by keyword, author, maintainer or scope. Built for dependency due diligence, competitor tracking and developer-tool lead generation. No API key, no proxy, no browser.

Use cases

• Dependency due diligence — before adopting a library: is it maintained, deprecated, single-maintainer, published with provenance, how big is it?
• Supply-chain monitoring — run daily on your package.json list; alert when deprecated, maintainers, lastPublisher or integrity changes.
• Competitor tracking — weekly downloads, dependents and release cadence of rival SDKs side by side.
• Ecosystem research — searchQueries: ["keywords:mcp"] ranked by popularity → who ships MCP servers, how fast the space grows.
• Developer-tool lead generation — find maintainers of packages in your niche (author:, maintainer: qualifiers) and their repos/homepages.
• Migration analytics — includeVersionDownloads shows how much traffic still sits on old majors of your own package.

Input

Field	Type	Default	Notes / allowed values
packages	string[]	[]	Package names, scoped or not. npmjs.com URLs and name@version are normalized; latest version is always reported.
searchQueries	string[]	[]	Free text for registry.npmjs.org/-/v1/search. Qualifiers: see Reference.
searchMaxItems	integer	25	1–10 000 per query (registry paginates 250/request, stops at offset 10 000).
searchQuality / searchPopularity / searchMaintenance	integer 0–100	registry default	Ranking weights (sent as 0.0–1.0).
searchExcludeUnstable	boolean	false	Appends not:unstable (drops 0.x).
searchExcludeInsecure	boolean	false	Appends not:insecure.
searchHydrate	boolean	false	Fetch the full profile for each search hit (2–4 requests per package).
versionsLimit	integer	10	0–100 recent versions in recentVersions.
includeDependencies	boolean	true	Include dependencies / peerDependencies / optionalDependencies maps.
includeDependents	boolean	true	Adds dependents, searchScore, insecure (1 extra request per package).
includeBundleSize	boolean	false	Adds bundle from bundlephobia.com (unofficial, slow, front-end libs only).
includeDownloadsYear	boolean	false	Adds downloadsYear.
downloadRange	string	""	last-day, last-week, last-month, last-year or YYYY-MM-DD:YYYY-MM-DD (max 18 months, data from 2015-01-10). Adds downloadsDaily + downloadsRange.
includeVersionDownloads	boolean	false	Adds versionDownloads (top 5 versions last week, latest / latest-major share).
fields	string[]	[]	Keep only these top-level fields (id and name always kept).

At least one of packages or searchQueries is required. Invalid downloadRange fails the run immediately with a message.

Reference

Search qualifiers (registry.npmjs.org -/v1/search)

Qualifier	Meaning	Example
keywords:a,b	package lists these keywords	keywords:mcp,agent
author:name	npm user is the author	author:sindresorhus
maintainer:name	npm user is a maintainer	maintainer:apify
scope:name	packages under @name/	scope:modelcontextprotocol
not:unstable / is:unstable	exclude / only versions < 1.0.0	hono not:unstable
not:insecure / is:insecure	exclude / only packages flagged insecure	keywords:auth not:insecure
boost-exact:false	do not boost exact name matches	request boost-exact:false

Free text matches name, description, keywords and README.

Download periods (api.npmjs.org)

Value	Window
last-day	previous UTC day
last-week	last 7 full days
last-month	last 30 full days
last-year	last 365 full days
YYYY-MM-DD:YYYY-MM-DD	any custom span up to 18 months

Weekly and monthly totals are fetched in bulk (128 unscoped names per request); scoped packages (@scope/name) are fetched one by one because the bulk endpoint does not support them. Counts are download requests, including CI and mirrors.

Score fields (searchScore)

quality, popularity, maintenance are 0–1 as computed by the npm search index; final is the weighted score used for ranking. Deprecated packages are demoted to the bottom of search results, so their dependents is usually null.

Examples

Vet the dependencies of a project

{ "packages": ["hono", "zod", "@modelcontextprotocol/sdk", "request"], "includeVersionDownloads": true }

Daily supply-chain watch — only the fields that matter, cheap

{ "packages": ["express", "lodash", "axios"], "includeDependencies": false, "includeDependents": false,
  "fields": ["version", "lastPublish", "lastPublisher", "maintainers", "deprecated", "integrity", "hasProvenance"] }

Map the MCP ecosystem by popularity

{ "searchQueries": ["keywords:mcp"], "searchMaxItems": 200, "searchPopularity": 100, "searchQuality": 0,
  "searchMaintenance": 0, "searchExcludeUnstable": true }

Leads: maintainers publishing in a niche, with repos and homepages

{ "searchQueries": ["keywords:x402", "keywords:agent-payments"], "searchMaxItems": 50, "searchHydrate": true,
  "fields": ["query", "version", "maintainers", "author", "repository", "homepage", "downloadsWeek", "releasesLast90d"] }

Download trend for a pricing/board deck

{ "packages": ["hono"], "downloadRange": "2026-03-01:2026-09-01", "includeDownloadsYear": true }

Output

One item per package. Trimmed real example (hono):

{
  "id": "hono", "name": "hono", "scope": null, "version": "4.13.7",
  "distTags": { "latest": "4.13.7", "next": "4.5.0-rc.2" },
  "description": "Web framework built on Web Standards", "license": "MIT",
  "homepage": "https://hono.dev", "repository": "https://github.com/honojs/hono",
  "npmUrl": "https://www.npmjs.com/package/hono",
  "author": "Yusuke Wada", "maintainers": ["yusukebe"], "maintainersCount": 1, "lastPublisher": "GitHub Actions",
  "created": "2021-12-14T20:08:48.105Z", "lastPublish": "2026-09-04T19:18:07.204Z",
  "daysSinceLastPublish": 8, "lastAnyPublish": "2026-09-04T19:18:07.204Z", "daysSinceAnyPublish": 8, "releasesLast90d": 17, "releasesLast365d": 68, "versionsCount": 449,
  "recentVersions": [{ "version": "4.13.7", "publishedAt": "2026-09-04T19:18:07.204Z" }],
  "deprecated": null, "deprecatedAllVersions": false, "deprecatedVersionsCount": 0,
  "hasTypes": true, "isEsm": true, "hasExports": true, "hasBin": false, "engines": { "node": ">=16.9.0" },
  "deps": 0, "peerDeps": 0, "optionalDeps": 0, "devDeps": 24, "dependencies": {},
  "unpackedSize": 1391192, "fileCount": 568, "hasProvenance": true,
  "downloadsWeek": 48737764, "downloadsMonth": 217131876, "dependents": 5566,
  "searchScore": { "final": 2214.9, "quality": 1, "popularity": 1, "maintenance": 1 }, "insecure": false,
  "sourceUrl": "https://registry.npmjs.org/hono", "fetchedAt": "2026-09-12T23:26:11.402Z"
}

Field	Type	Description
id, name, scope	string	Stable id = package name; scope like @x402 or null.
version, distTags	string, object	Latest version and all dist-tags (latest, next, beta…).
description, license, homepage, repository, bugs, npmUrl, keywords	—	Repository URL normalized to https://… (git+, ssh, shorthand handled).
author, maintainers, maintainersCount, lastPublisher	—	lastPublisher = npm user (or "GitHub Actions" for trusted publishing) who pushed the latest version.
created, modified, firstPublish	ISO	Timeline (modified also moves on metadata-only changes).
lastPublish, daysSinceLastPublish	ISO / number	Release date of the latest dist-tag version and days since then — "how old is what npm install gives you".
lastAnyPublish, daysSinceAnyPublish	ISO / number	Newest publish of any version, incl. backports to older majors and prereleases (express 4.x patches, next tags) — "is anyone still releasing". The two differ for packages that maintain several lines.
releasesLast90d, releasesLast365d, versionsCount, recentVersions	number / array	Publish cadence. Hundreds of releases per 90 days is a spam/auto-publish signal.
deprecated, deprecatedAllVersions, deprecatedVersionsCount	string|null, boolean, number	Deprecation message on the latest version vs. whole-package deprecation.
hasTypes, isEsm, hasExports, hasBin, engines, funding	—	Packaging facts of the latest version.
deps, peerDeps, optionalDeps, devDeps, dependencies, peerDependencies, optionalDependencies	numbers / maps	Depth-1 dependency tree of the latest version.
unpackedSize, fileCount, tarball, integrity, hasProvenance, provenanceUrl	—	Artifact facts; integrity changing without a version bump is a red flag.
downloadsWeek, downloadsMonth, downloadsYear, downloadsRange, downloadsDaily	number / object / array	From api.npmjs.org; null when npm has no stats yet.
versionDownloads	object	{ total, latestShare, latestMajorShare, top[] } for last week.
dependents, searchScore, insecure, unstable	—	From the search index (null if the package is not found by its own name).
bundle	object	{ size, gzip, dependencyCount, version } from bundlephobia, optional.
query, hydrated, hydrateError	—	Present for items that came from searchQueries.
sourceUrl, fetchedAt	string	Registry document URL and UTC timestamp.

Search-mode items without searchHydrate carry the subset available in the index: name, version, description, license, links, maintainers, lastPublish, weekly/monthly downloads, dependents, searchScore, insecure, unstable, hydrated: false.

Use it from code / agents

Apify API (curl)

curl -X POST "https://api.apify.com/v2/acts/yadroo~npm-package-intel/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"packages":["hono","@x402/hono"],"includeVersionDownloads":true}'

JavaScript (apify-client)

import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('yadroo/npm-package-intel').call({ searchQueries: ['keywords:mcp'], searchMaxItems: 100 });
const { items } = await client.dataset(run.defaultDatasetId).listItems();

Python (apify-client)

from apify_client import ApifyClient
client = ApifyClient(token)
run = client.actor("yadroo/npm-package-intel").call(run_input={"packages": ["requests-like", "hono"]})
items = client.dataset(run["defaultDatasetId"]).list_items().items

MCP — add https://mcp.apify.com to Claude, Cursor or any MCP client and call the yadroo/npm-package-intel tool with the same JSON input.

Pricing

Pay per event: $0.001 per run start + $0.002 per dataset item (package). Packages that are not on the registry or could not be fetched are not items and are not charged — they are listed in the SUMMARY record of the default key-value store (notFound[], errors[{input, error}], with counts) and in the run's status message. The run fails only when no package could be fetched at all. Typical runs: 10 packages ≈ $0.021; a 200-package ecosystem search ≈ $0.401; a daily 50-package watch ≈ $0.101/day.

Limits & FAQ

• Rate limits. The registry and api.npmjs.org have no published quota; the Actor waits ~120 ms between packages, retries 429/5xx three times with backoff, and fails the item (not the run) if a package still cannot be fetched.
• Freshness. Metadata is live from the registry. Download counts are aggregated by npm once a day and lag ~24 h; "last-week" ends yesterday (UTC).
• New packages have downloadsWeek: null with a warning in the log — npm has no stats yet.
• Dependents come from the search index; packages that do not show up in the top-20 hits for their own name (typically deprecated ones) get null.
• Bundle size uses an unofficial bundlephobia endpoint that can take 10–20 s per cold package or fail for native/Node-only packages; it is off by default and never fails the item.
• Scoped packages cost one extra download request each (bulk endpoint limitation).
• What is NOT included: vulnerability advisories (use npm audit / OSV), GitHub stars (use GitHub Repo Intel), install-time dependency tree beyond depth 1.
• Roadmap: OSV vulnerability lookup, diff mode against a previous run for change alerts.

---

Made by Yadroo. Sibling actors: GitHub Repo Intel · PyPI Package Intel · Hacker News Search · Stack Exchange Search