# npm License & Deprecation Checker (`taroyamada/npm-package-intelligence`) Actor

Scan public npm packages and licenses. No API key / no login. Open Input → leave defaults → Start: https://console.apify.com/actors/ivMEyrWq3gHHTquzb/input From USD 0.

- **URL**: https://apify.com/taroyamada/npm-package-intelligence.md
- **Developed by:** [naoki anzai](https://apify.com/taroyamada) (community)
- **Categories:** Developer tools, Automation, AI
- **Features:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $8.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## NPM Package Intelligence API | Downloads, Dependencies & Licenses

**What you get:** one row per npm package with the latest version, description, license, maintainers, dependencies, deprecation status, and release cadence (first and last publish, version count, average days between releases).

Sample output from real runs (2026-10-18: the JSON below returns the `react` row; the Console prefill `express`, `react` returns 2 rows):

| name | version | license | maintainers | dependencyCount | versionsCount | lastPublished | avgDaysBetweenReleases |
|---|---|---|---|---|---|---|---|
| react | 19.3.1 | MIT | fb, react-bot | 0 | 2979 | 2026-10-15 | 2 |
| express | 5.3.0 | MIT | wesleytodd, jonchurch, ctcpip, ulisesgascon, sheplu | 28 | 290 | 2026-10-09 | 20 |

Pricing: USD 0.00005 per run plus USD 0.008 per package row.

[Open Input (leave defaults → Start)](https://console.apify.com/actors/ivMEyrWq3gHHTquzb/input)
Paid first-run JSON ≈ **USD 0.008** (1 package row USD 0.008 + actor start USD 0.00005). Keep reports, exports, and movement options bounded for the first run. Open Console Input (deep link above) and run this JSON.

```json
{
  "packages": [
    "react"
  ],
  "searchTerm": "",
  "searchSize": 1,
  "includeDownloads": false,
  "concurrency": 1,
  "timeoutMs": 10000,
  "delivery": "dataset",
  "webhookUrl": "",
  "dryRun": false
}
```

Paste package name and Start.

Audit public npm libraries for deprecated versions, abandoned repositories, and specific open-source licenses to guarantee a secure software supply chain. This specialized npm license scraper and deprecation checker enables engineering teams and compliance officers to systematically evaluate third-party JavaScript dependencies. Rather than manually inspecting individual repository web pages, you can run bulk scans across your entire dependency tree to extract actionable metadata directly from the official npm platform. Users frequently deploy this tool to enforce corporate compliance policies, ensuring that no unauthorized licenses slip into production codebases. It is also an essential asset for identifying abandoned packages that lack recent updates or have active deprecation flags, which often signal impending security vulnerabilities. Running this scraper on a weekly schedule empowers teams to maintain automated watchlists and catch risky dependencies before they are merged. Each execution yields highly detailed, structured results, featuring the exact open-source license, deprecation status, author contact details, direct dependency arrays, repository URLs, and current weekly download stats. Automate your open-source governance, extract critical security details, and eliminate the blind spots in your node modules using precision data extraction tools.

### Store Quickstart

- Start with 3–5 exact package names in `packages` for the cleanest first run.
- Add `searchTerm` only when you need discovery, and keep `searchSize` around 10–20 until you know the category you want.
- Use `dryRun: true` to validate webhook or dataset delivery before a larger audit.
- After the first useful run, move the account to the recurring watchlist template, then use the webhook handoff template for release alerts or downstream actions.

### Use with Apify MCP

Exact actor: `taroyamada/npm-package-intelligence`

Sample input JSON:

```json
{
  "packages": [
    "express"
  ],
  "includeDownloads": true,
  "concurrency": 5,
  "delivery": "dataset"
}
```

### Key Features

- 📦 **Full package metadata** — version, description, author, homepage, repo
- 📥 **Weekly download stats** — Usage signal for popularity
- 🔗 **Dependencies tree** — Direct deps with version specs
- ⚖️ **License info** — MIT, Apache-2.0, GPL-3.0 detection
- ⚠️ **Deprecation detection** — Flags deprecated packages
- 🔑 **No API key needed** — Uses official npm registry

### Use Cases

| Who | Why |
|-----|-----|
| **DevOps teams** | Dependency security audits |
| **Engineering leaders** | Track tech stack across projects |
| **OSS maintainers** | Competitor package analysis |
| **License compliance** | Verify all deps are commercially usable |
| **Recruiters/founders** | Research packages/maintainers for hiring |

### Input

| Field | Type | Default | Description |
|-------|------|---------|-------------|
| packages | string\[] | (required) | npm package names (max 100) |
| includeDownloads | boolean | true | Weekly download stats |

#### Input Example

```json
{
  "packages": ["express", "react", "axios"],
  "includeDownloads": true
}
```

### Input Examples

#### Example: One package

```json
{
  "packages": [
    "express"
  ]
}
```

#### Example: Several packages

```json
{
  "packages": [
    "express",
    "react",
    "axios"
  ]
}
```

#### Example: Search npm by keyword

```json
{
  "searchTerm": "csv parser",
  "searchSize": 3
}
```

### Output

| Field | Type | Description |
|-------|------|-------------|
| `name` | string | Package name |
| `version` | string | Latest version |
| `description` | string | Package description |
| `downloads` | object | Download stats by period (if includeDownloads) |
| `downloads.lastWeek` | integer | Last 7 days downloads |
| `downloads.lastMonth` | integer | Last 30 days downloads |
| `vulnerabilities` | object\[] | Known CVEs (if includeVulnerabilities) |
| `maintainers` | string\[] | Maintainer usernames |
| `license` | string | SPDX license identifier |
| `repository` | string | Source repo URL |

#### Output Example

```json
{
  "name": "express",
  "version": "4.21.2",
  "description": "Fast, unopinionated web framework",
  "author": "TJ Holowaychuk",
  "license": "MIT",
  "dependencies": {"body-parser": "~1.20.0"},
  "weeklyDownloads": 32000000,
  "deprecated": false
}
```

### API Usage

Run this actor programmatically using the Apify API. Replace `YOUR_API_TOKEN` with your token from [Apify Console → Settings → Integrations](https://console.apify.com/account/integrations).

#### cURL

```bash
curl -X POST "https://api.apify.com/v2/acts/taroyamada~npm-package-intelligence/run-sync-get-dataset-items?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "packages": ["express", "react", "axios"], "includeDownloads": true }'
```

#### Python

```python
from apify_client import ApifyClient

client = ApifyClient("YOUR_API_TOKEN")
run = client.actor("taroyamada/npm-package-intelligence").call(run_input={
  "packages": ["express", "react", "axios"],
  "includeDownloads": true
})

for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)
```

#### JavaScript / Node.js

```javascript
import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_API_TOKEN' });
const run = await client.actor('taroyamada/npm-package-intelligence').call({
  "packages": ["express", "react", "axios"],
  "includeDownloads": true
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);
```

### Tips & Limitations

- Audit your dependency list monthly to catch new CVEs and abandoned packages.
- Track competitor packages' download trends for market intel.
- Combine with GitHub data for full open-source intelligence.
- Use in CI/CD to fail builds when vulnerabilities are introduced.

### FAQ

**Where do download stats come from?**

npm's official npms.io API. Weekly counts are reliable popularity signals.

**Can I get security vulnerability data?**

Not directly. Pair with npm audit or Snyk for security scanning.

**Does it work with private packages?**

No — only public npm registry. Private packages require authentication.

**Deprecated packages?**

Flagged via the 'deprecated' field. Useful for migration planning.

**Where do vulnerabilities come from?**

GitHub Advisory Database via the npm audit endpoint.

**Are private npm packages supported?**

Public packages only. Private registries require authentication that this actor doesn't handle.

### Related Actors

Pair this actor with other flagship intelligence APIs in the same portfolio:

- [PyPI Package Intelligence API](https://apify.com/taroyamada/pypi-package-intelligence) — audit Python packages with release history, dependency declarations, and optional OSV signals.
- [Docker Hub Image Intelligence API](https://apify.com/taroyamada/dockerhub-image-intelligence) — inspect public container repositories, tags, pulls, and star signals for supply-chain research.
- [Shopify Store Intelligence API](https://apify.com/taroyamada/shopify-store-intelligence) — add public storefront and catalog context when evaluating ecommerce stacks built on these packages.

### Pricing & Cost Control

Apify Store pricing is usage-based, so total cost mainly follows how many packages you process and whether you also run discovery via `searchTerm`. Check the Store pricing card for the current per-event rates.

- Start with a short `packages` list or keep `searchSize` small for discovery runs.
- Turn `includeDownloads` on only when popularity signals matter.
- Use `dryRun: true` to validate the input before larger audits.
- Prefer dataset delivery while iterating; switch to webhooks once the payload shape is stable.

### ⭐ Was this helpful?

If this actor saved you time, please [**leave a ★ rating**](https://apify.com/taroyamada/npm-package-intelligence/reviews) on Apify Store. It takes 10 seconds, helps other developers discover it, and keeps updates free.

Bug report or feature request? Open an issue on the [Issues tab](https://apify.com/taroyamada/npm-package-intelligence/issues) of this actor.

# Actor input Schema

## `packages` (type: `array`):

Leave the prefilled express and react package names and click Start for the first npm intelligence report. Or enter your own public npm package names.

## `searchTerm` (type: `string`):

Optional keyword to search the npm registry (registry.npmjs.org/-/v1/search). Leave blank to skip search.

## `searchSize` (type: `integer`):

Maximum number of search results to return (1–250).

## `includeDownloads` (type: `boolean`):

Include download statistics (last-day, last-week, last-month) from api.npmjs.org.

## `concurrency` (type: `integer`):

Number of parallel package requests.

## `timeoutMs` (type: `integer`):

Request timeout in milliseconds.

## `delivery` (type: `string`):

Where to send results: Apify dataset or webhook URL.

## `webhookUrl` (type: `string`):

Webhook URL to POST results to (only used when delivery=webhook).

## `dryRun` (type: `boolean`):

Parse input and fetch data but do not push to dataset or call webhook.

## Actor input object example

```json
{
  "packages": [
    "express"
  ],
  "searchSize": 1,
  "includeDownloads": true,
  "concurrency": 1,
  "timeoutMs": 15000,
  "delivery": "dataset",
  "dryRun": false
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "express"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("taroyamada/npm-package-intelligence").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packages": ["express"] }

# Run the Actor and wait for it to finish
run = client.actor("taroyamada/npm-package-intelligence").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "express"
  ]
}' |
apify call taroyamada/npm-package-intelligence --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,taroyamada/npm-package-intelligence"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/ivMEyrWq3gHHTquzb/builds/22AMOPqTSPhoePTqi/openapi.json