npm Package Intel — Downloads, Dependents, Health, Search

One clean JSON per npm package: latest version and dist-tags, weekly/monthly/yearly downloads, daily download series, number of dependents, publish cadence (releases in the last 90/365 days, days since last publish), deprecation status, license, repository, TypeScript/ESM/provenance flags, dependency counts and maps, package size — plus a registry search mode to discover packages by keyword, author, maintainer or scope. Built for dependency due diligence, competitor tracking and developer-tool lead generation. No API key, no proxy, no browser.

Use cases

• Dependency due diligence — before adopting a library: is it maintained, deprecated, single-maintainer, published with provenance, how big is it?
• Supply-chain monitoring — run daily on your package.json list; alert when deprecated, maintainers, lastPublisher or integrity changes.
• Competitor tracking — weekly downloads, dependents and release cadence of rival SDKs side by side.
• Ecosystem research — searchQueries: ["keywords:mcp"] ranked by popularity → who ships MCP servers, how fast the space grows.
• Developer-tool lead generation — find maintainers of packages in your niche (author:, maintainer: qualifiers) and their repos/homepages.
• Migration analytics — includeVersionDownloads shows how much traffic still sits on old majors of your own package.

Input

Field	Type	Default	Notes / allowed values
packages	string[]	[]	Package names, scoped or not. npmjs.com URLs and name@version are normalized; latest version is always reported. Letter case: see Reference.
searchQueries	string[]	[]	Free text for registry.npmjs.org/-/v1/search. Qualifiers: see Reference.
searchMaxItems	integer	25	Top 1–10 000 hits per query (registry paginates 250/request, stops at offset 10 000). A package found by several queries, or also listed in packages, is saved once, under the first.
searchQuality / searchPopularity / searchMaintenance	integer 0–100	registry default	Ranking weights (sent as 0.0–1.0).
searchExcludeUnstable	boolean	false	Appends not:unstable (drops 0.x).
searchExcludeInsecure	boolean	false	Appends not:insecure.
searchHydrate	boolean	false	Fetch the full profile for each search hit (the registry document plus optional lookups, ~1–1.5 s per package — see Limits).
versionsLimit	integer	10	0–100 recent versions in recentVersions.
includeDependencies	boolean	true	Include dependencies / peerDependencies / optionalDependencies maps.
includeDependents	boolean	true	Adds dependents, searchScore, insecure, unstable (1 extra request per package; search hits already carry them).
includeBundleSize	boolean	false	Adds bundle from bundlephobia.com (unofficial, slow, front-end libs only).
includeDownloadsYear	boolean	false	Adds downloadsYear.
downloadRange	string	""	last-day, last-week, last-month, last-year or YYYY-MM-DD:YYYY-MM-DD (max 18 months, data from 2015-01-10). Adds downloadsDaily + downloadsRange.
includeVersionDownloads	boolean	false	Adds versionDownloads (top 5 versions last week, latest / latest-major share).
fields	string[]	[]	Keep only these top-level fields, in your order (id and name always kept, first unless you list them). Case, spaces and snake_case (downloads_week) do not matter.

At least one of packages or searchQueries is required. These fail the run at once with a message that says what to change (nothing is charged but the start): no usable input, only inputs that cannot be npm names (Has Spaces), an invalid downloadRange, and a fields list of which no name can appear in the rows of your input. Softer problems do not stop the run; each is named in the status message and in SUMMARY.inputNotes: an unknown fields name is left out with a "did you mean" (versoin → version), and a field that needs a switch you left off (bundle without includeBundleSize) is left out with the switch it needs.

Reference

Package names and letter case

New npm names are lower-case, but legacy packages keep capitals (JSONStream). A name is looked up as typed; if the registry does not have it, in lower case (React → react); then with the capitals the search index lists for a legacy package of that name. The first one that exists wins, so type a legacy name with its capitals: jsonstream is a different (small) package, not JSONStream. Only the letter case may differ — a misspelled name is reported as not found, never swapped for a similar package. Every case correction is named in the status message and SUMMARY.corrected. Inputs that cannot be npm names (spaces, other characters) are skipped and listed in SUMMARY.invalidNames.

Search qualifiers (registry.npmjs.org -/v1/search)

Qualifier	Meaning	Example
keywords:a,b	package lists these keywords	keywords:mcp,agent
author:name	npm user is the author	author:sindresorhus
maintainer:name	npm user is a maintainer	maintainer:apify
scope:name	packages under @name/	scope:modelcontextprotocol
not:unstable / is:unstable	exclude / only versions < 1.0.0	hono not:unstable
not:insecure / is:insecure	exclude / only packages flagged insecure	keywords:auth not:insecure
boost-exact:false	do not boost exact name matches	request boost-exact:false

Free text matches name, description, keywords and README.

Download periods (api.npmjs.org)

Value	Window
last-day	previous UTC day
last-week	last 7 full days
last-month	last 30 full days
last-year	last 365 full days
YYYY-MM-DD:YYYY-MM-DD	any custom span up to 18 months

Weekly and monthly totals come with the package's own entry in the npm search index when the run has it (search hits, and packages looked up with includeDependents) — npm publishes the same numbers there as on api.npmjs.org. Otherwise they come from api.npmjs.org in bulk (128 unscoped names per request; scoped packages one by one, because the bulk endpoint does not take scopes). Yearly totals and the daily series always come from api.npmjs.org. Counts are download requests, including CI and mirrors.

Score fields (searchScore)

quality, popularity, maintenance are 0–1 as computed by the npm search index; final is the weighted score used for ranking. Deprecated packages are demoted to the bottom of search results, so their dependents is usually null.

Examples

Vet the dependencies of a project

{ "packages": ["hono", "zod", "@modelcontextprotocol/sdk", "request"], "includeVersionDownloads": true }

Daily supply-chain watch — only the fields that matter, cheap

{ "packages": ["express", "lodash", "axios"], "includeDependencies": false, "includeDependents": false,
  "fields": ["version", "lastPublish", "lastPublisher", "maintainers", "deprecated", "integrity", "hasProvenance"] }

Map the MCP ecosystem by popularity

{ "searchQueries": ["keywords:mcp"], "searchMaxItems": 200, "searchPopularity": 100, "searchQuality": 0,
  "searchMaintenance": 0, "searchExcludeUnstable": true }

Leads: maintainers publishing in a niche, with repos and homepages

{ "searchQueries": ["keywords:x402", "keywords:agent-payments"], "searchMaxItems": 50, "searchHydrate": true,
  "fields": ["query", "version", "maintainers", "author", "repository", "homepage", "downloadsWeek", "releasesLast90d"] }

Download trend for a pricing/board deck

{ "packages": ["hono"], "downloadRange": "2026-03-01:2026-09-01", "includeDownloadsYear": true }

Output

One item per package (one row per package per run, whichever input or query found it first). Trimmed real example (hono):

{
  "id": "hono", "name": "hono", "scope": null, "version": "4.13.7",
  "distTags": { "latest": "4.13.7", "next": "4.5.0-rc.2" },
  "description": "Web framework built on Web Standards", "license": "MIT",
  "homepage": "https://hono.dev", "repository": "https://github.com/honojs/hono",
  "npmUrl": "https://www.npmjs.com/package/hono",
  "author": "Yusuke Wada", "maintainers": ["yusukebe"], "maintainersCount": 1, "lastPublisher": "GitHub Actions",
  "created": "2021-12-14T20:08:48.105Z", "lastPublish": "2026-09-04T19:18:07.204Z",
  "daysSinceLastPublish": 8, "lastAnyPublish": "2026-09-04T19:18:07.204Z", "daysSinceAnyPublish": 8, "releasesLast90d": 17, "releasesLast365d": 68, "versionsCount": 449,
  "recentVersions": [{ "version": "4.13.7", "publishedAt": "2026-09-04T19:18:07.204Z" }],
  "deprecated": null, "deprecatedAllVersions": false, "deprecatedVersionsCount": 0,
  "hasTypes": true, "isEsm": true, "hasExports": true, "hasBin": false, "engines": { "node": ">=16.9.0" },
  "deps": 0, "peerDeps": 0, "optionalDeps": 0, "devDeps": 24, "dependencies": {},
  "unpackedSize": 1391192, "fileCount": 568, "hasProvenance": true,
  "downloadsWeek": 48737764, "downloadsMonth": 217131876, "dependents": 5566,
  "searchScore": { "final": 2214.9, "quality": 1, "popularity": 1, "maintenance": 1 }, "insecure": false,
  "sourceUrl": "https://registry.npmjs.org/hono", "fetchedAt": "2026-09-12T23:26:11.402Z"
}

Field	Type	Description
id, name, scope	string	Stable id = package name; scope like @x402 or null.
version, distTags	string, object	Latest version and all dist-tags (latest, next, beta…).
description, license, homepage, repository, bugs, npmUrl, keywords	—	Repository URL normalized to https://… (git+, ssh, shorthand handled).
author, maintainers, maintainersCount, lastPublisher	—	lastPublisher = npm user (or "GitHub Actions" for trusted publishing) who pushed the latest version.
created, modified, firstPublish	ISO	Timeline (modified also moves on metadata-only changes).
lastPublish, daysSinceLastPublish	ISO / number	Release date of the latest dist-tag version and days since then — "how old is what npm install gives you".
lastAnyPublish, daysSinceAnyPublish	ISO / number	Newest publish of any version, incl. backports to older majors and prereleases (express 4.x patches, next tags) — "is anyone still releasing". The two differ for packages that maintain several lines.
releasesLast90d, releasesLast365d, versionsCount, recentVersions	number / array	Publish cadence. Hundreds of releases per 90 days is a spam/auto-publish signal.
deprecated, deprecatedAllVersions, deprecatedVersionsCount	string|null, boolean, number	Deprecation message on the latest version vs. whole-package deprecation.
hasTypes, isEsm, hasExports, hasBin, engines, funding	—	Packaging facts of the latest version.
deps, peerDeps, optionalDeps, devDeps, dependencies, peerDependencies, optionalDependencies	numbers / maps	Depth-1 dependency tree of the latest version.
unpackedSize, fileCount, tarball, integrity, hasProvenance, provenanceUrl	—	Artifact facts; integrity changing without a version bump is a red flag.
downloadsWeek, downloadsMonth, downloadsYear, downloadsRange, downloadsDaily	number / object / array	npm's download counts (see Reference → Download periods); null when npm has no stats yet or the lookup failed (SUMMARY.optionalLookupsFailed names it).
versionDownloads	object	{ total, latestShare, latestMajorShare, top[] } for last week.
dependents, searchScore, insecure, unstable	—	From the search index (null if the package is not found by its own name).
bundle	object	{ size, gzip, dependencyCount, version } from bundlephobia, optional.
query, hydrated, hydrateError	—	query = the search query that found the package (null for packages); hydrated/hydrateError only on rows from searchQueries.
sourceUrl, fetchedAt	string	Registry document URL and UTC timestamp.

An optional column you switched on is always present: null means "asked, but not available" (bundlephobia has no build, the lookup failed), so an agent can tell it from "not asked". Search-mode items without searchHydrate carry the subset available in the index: name, version, description, license, links, maintainers, lastPublish, weekly/monthly downloads, dependents, searchScore, insecure, unstable, hydrated: false. A search hit whose full profile could not be fetched (with searchHydrate) is still saved with its search data and hydrateError saying why.

The run's SUMMARY record (default key-value store) lists what is not in the dataset: notFound, invalidNames, errors (packages that could not be fetched), corrected (letter case), queries (per query: registry total, hits, saved = how many of them are in the dataset, error), optionalLookupsFailed, inputNotes, notReached and stoppedBy when the run stopped early.

Use it from code / agents

Apify API (curl)

curl -X POST "https://api.apify.com/v2/acts/yadroo~npm-package-intel/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"packages":["hono","@x402/hono"],"includeVersionDownloads":true}'

JavaScript (apify-client)

import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('yadroo/npm-package-intel').call({ searchQueries: ['keywords:mcp'], searchMaxItems: 100 });
const { items } = await client.dataset(run.defaultDatasetId).listItems();

Python (apify-client)

from apify_client import ApifyClient
client = ApifyClient(token)
run = client.actor("yadroo/npm-package-intel").call(run_input={"packages": ["requests-like", "hono"]})
items = client.dataset(run["defaultDatasetId"]).list_items().items

MCP — add https://mcp.apify.com to Claude, Cursor or any MCP client and call the yadroo/npm-package-intel tool with the same JSON input.

Pricing

Pay per event: $0.001 per run start + $0.002 per dataset item (package). Bronze −10 %, Silver −20 %, Gold and above −30 % on the item price; the start event is the same on every plan; platform usage is included.

Packages that are not on the registry, inputs that are not npm names and packages that could not be fetched are not items and are not charged — they are listed in the SUMMARY record of the default key-value store (notFound[], invalidNames[], errors[{input, error}], with counts) and in the run's status message. The run fails only when nothing could be fetched at all (or the input is unusable), and then costs only the start fee.

The run never charges more than your max cost per run: it fetches profiles only for the packages the limit still pays for, stops there and ends with the status "Stopped at your spending limit: N rows delivered".

Typical runs: 10 packages ≈ $0.021; a 200-package ecosystem search ≈ $0.401; a daily 50-package watch ≈ $0.101/day.

Limits & FAQ

• Rate limits. The registry and api.npmjs.org publish no quota, but the registry answers bursts (about a dozen searches in a row) with HTTP 429. The Actor therefore works one package at a time, keeps registry requests at least 300 ms apart and searches one per second, pauses every request to a host for at least 5 s (or its Retry-After) after a 429, retries 429/5xx a few times, and reports a package that still cannot be fetched in SUMMARY.errors (not charged) instead of failing the run. A search query that fails is reported the same way; the other queries and packages still run.
• Speed and capacity. A full profile takes about 1–1.5 s on average (registry document, the dependents search — one per second at most — and downloads); packages with thousands of versions such as next or drizzle-orm take 20–40 s for their registry document alone. With the default 15-minute timeout one run handles roughly 500 full profiles (packages, or searchHydrate), fewer for lists of very large packages; lightweight search rows are much faster (250 per request). A run close to its timeout stops starting new packages, finishes the ones it has started, keeps everything it saved and ends SUCCEEDED with "Stopped before the run timeout: N rows saved" — the rest is counted in SUMMARY.notReached. For more, raise the timeout or split the list.
• Freshness. Metadata is live from the registry. Download counts are aggregated by npm once a day and lag ~24 h; "last-week" ends yesterday (UTC).
• New packages have downloadsWeek: null with a warning in the log — npm has no stats yet.
• Dependents come from the search index; packages that do not show up in the top-20 hits for their own name (typically deprecated ones) get null.
• Bundle size uses an unofficial bundlephobia endpoint that can take 10–20 s per cold package or fail for native/Node-only packages; it is off by default and never fails the item.
• Scoped packages cost one extra download request each when their counts are not in the search index (bulk endpoint limitation); api.npmjs.org answers long runs of such requests with HTTP 429, which the Actor waits out with growing pauses.
• Big packages (thousands of versions: next, typescript) have registry documents of tens of MB; the Actor reads them as a stream and keeps only what the row needs, so they fit the default 256 MB.
• What is NOT included: vulnerability advisories (use npm audit / OSV), GitHub stars (use GitHub Repo Intel), install-time dependency tree beyond depth 1.
• Roadmap: OSV vulnerability lookup, diff mode against a previous run for change alerts.

---

Made by Yadroo. Sibling actors: GitHub Repo Intel · PyPI Package Intel · Hacker News Search · Stack Exchange Search