npm Package Scraper · Versions, Downloads, Deps & Maintainers

npm Package Scraper and npm scraper that searches the npm registry on npmjs.com and returns one structured row per package: the latest version, weekly and monthly downloads, how many other packages depend on it, its dependencies, its full publish history, licence, maintainers and the registry's own quality, popularity and maintenance scores.

Maintained by reapX. Every row cites the Apify run that produced it — nothing is inferred, modelled or filled in, and a field absent from the source is absent from the row. The extracted archive for this source is browsable at reapx.dev/data/npm-package-scraper/ and mirrored as an open dataset on Hugging Face and Kaggle. Questions: reapxdev@proton.me

What you get per package

Field
packageName	the permanent registry name, stable across runs
version · description · keywords · license	the listing
weeklyDownloads · monthlyDownloads · dependentCount	real usage, not stars
dependencies · dependencyCount · devDependencyCount	what it pulls in
versionCount · firstPublishedAt · lastPublishedAt	how long it has been maintained
maintainers · maintainerCount · publisher	who can publish to it
isDeprecated · hasTypeScriptTypes · nodeEngine	fitness for use
unpackedSizeBytes · fileCount	install weight
qualityScore · popularityScore · maintenanceScore	the registry's own 0-1 scores
repositoryUrl · homepageUrl · npmUrl · retrievedAt

How to scrape npm packages and audit dependency trees

Put your package.json dependency names into Specific package names. Every row comes back with maintainerCount, lastPublishedAt, isDeprecated and license, which is the whole of a first-pass supply-chain review: single-maintainer packages, packages untouched for years, packages already deprecated, and licences you cannot ship.

Track an organisation's packages

Set Scope to babel, angular, nestjs or your own org and schedule the run. Each run captures every package under that scope with its current version and download counts, so a new release or a sudden drop shows up as a diff between runs on the same packageName.

Find the real leaders in a category

Set Keyword to testing, orm, bundler - anything the ecosystem tags - then set Minimum dependent packages to something like 100. dependentCount is a far harder signal than downloads: it counts packages that took a build-time bet on the library.

Input configuration

Every field is optional. The prefilled values below are what runs if you press Start without changing anything.

What to pull

Give queries, package names, or one of the shortcuts below.

Field	Type	Accepts	What it does
searchQueries	list	one value per line	Registry search queries, one per line. Plain text works, and so do npm's own qualifiers: keywords:graphql, author:sindresorhus, maintainer:vercel, scope:babel, not:deprecated, is:unstable. Results from every query are merged and deduplicated. Prefilled with ["keywords:cli"].
packageNames	list	one value per line	Exact package names to pull, one per line, including scoped names such as @types/node.
keyword	string	free text	Shortcut for keywords:
maintainer	string	free text	Shortcut for maintainer:
scope	string	free text	Shortcut for scope:

Filters

All optional.

Field	Type	Accepts	What it does
minWeeklyDownloads	integer	0 to 1000000000	Keep only packages downloaded at least this many times in the last week.
minDependents	integer	0 to 1000000	Keep only packages that at least this many other registry packages depend on - the clearest signal that a library is load-bearing.
excludeDeprecated	true/false	checkbox	Drop packages whose latest version carries a deprecation notice.

Output

Row depth, volume and politeness.

Field	Type	Accepts	What it does
includeVersionDetail	true/false	checkbox	Read each package's full registry record for version count, first and last publish dates, dependencies, tarball size and deprecation. Turn off for a faster, shallower run. Prefilled with true.
maxPackages	integer	1 to 5000	Hard ceiling on the rows this run produces, and therefore on what it costs. You are charged per package returned. Prefilled with 50.
requestsPerSecond	integer	1 to 10	Politeness against the npm registry. Lower this if you see the registry refusing requests. Prefilled with 5.

Pricing

Pay per event. The primary event is Package returned (package-returned), charged at $0.002 per event on the free plan, falling to $0.001 on the highest tier.

One npm package delivered as a complete row, including downloads, dependents, dependencies and publish history. Blocked sources and empty result sets are never charged.

Other charged events: apify-actor-start (Actor Start).

Minimum charge cap per run: $0.05.

Tiered discounts apply automatically on every paid Apify plan. Platform usage is absorbed by the Actor, so the per-event price is the whole price.

Usage examples

The prefilled run, which is what Start does with nothing changed

{
  "searchQueries": [
    "keywords:cli"
  ],
  "includeVersionDetail": true,
  "maxPackages": 50,
  "requestsPerSecond": 5
}

Filter by search queries

{
  "searchQueries": [
    "keywords:graphql",
    "author:sindresorhus"
  ],
  "includeVersionDetail": true,
  "maxPackages": 50,
  "requestsPerSecond": 5
}

Filter by specific package names

{
  "searchQueries": [
    "keywords:cli"
  ],
  "includeVersionDetail": true,
  "maxPackages": 50,
  "requestsPerSecond": 5,
  "packageNames": [
    "express",
    "@types/node"
  ]
}

Filter by keyword

{
  "searchQueries": [
    "keywords:cli"
  ],
  "includeVersionDetail": true,
  "maxPackages": 50,
  "requestsPerSecond": 5,
  "keyword": "testing"
}

Filter by maintainer

{
  "searchQueries": [
    "keywords:cli"
  ],
  "includeVersionDetail": true,
  "maxPackages": 50,
  "requestsPerSecond": 5,
  "maintainer": "sindresorhus"
}

Output example

One row, exactly as the actor wrote it to the dataset:

{
  "packageName": "commander",
  "version": "15.0.0",
  "description": "the complete solution for node.js command-line programs",
  "keywords": [
    "commander",
    "command",
    "option",
    "parser",
    "cli",
    "argument",
    "args",
    "argv"
  ],
  "license": "MIT",
  "publisher": "abetomo",
  "maintainers": [
    "shadowspawn",
    "abetomo"
  ],
  "maintainerCount": 2,
  "weeklyDownloads": 474004587,
  "monthlyDownloads": 1853856927,
  "dependentCount": 144047,
  "dependencies": [],
  "dependencyCount": 0,
  "devDependencyCount": 9,
  "versionCount": 124,
  "firstPublishedAt": "2011-08-14T22:17:51.639Z",
  "lastPublishedAt": "2026-05-29T09:16:23.183Z",
  "isDeprecated": false
}

That row carries 29 fields in total; 18 are shown.

Fields on every row

Field	Type	What it is
packageName	string	The package's permanent name on the npm registry. Unique, stable across runs, and the right key to join runs together over time.
version	string	The version currently tagged latest.
description	string	The package's own one-line summary.
keywords	list	The keywords the package declares, used by registry search.
license	string	The SPDX licence identifier the package declares.
publisher	string	The npm user who published the latest version.
maintainers	list	Every npm user with publish rights on the package.
maintainerCount	integer	How many maintainers the package has - a one-maintainer dependency is a different risk from a ten-maintainer one.
weeklyDownloads	integer	Downloads in the last full week, as reported by the registry.
monthlyDownloads	integer	Downloads in the last full month, as reported by the registry.
dependentCount	integer	How many other registry packages depend on this one.
dependencies	list	The runtime dependencies the latest version declares.
dependencyCount	integer	How many runtime dependencies the latest version pulls in.
devDependencyCount	integer	How many development dependencies the latest version declares.
versionCount	integer	How many versions have ever been published.
firstPublishedAt	string	When the package first appeared on the registry, in UTC.
lastPublishedAt	string	When the package was last published to, in UTC - the freshest maintenance signal there is.
isDeprecated	true/false	True when the latest version carries a deprecation notice.
hasTypeScriptTypes	true/false	True when the latest version declares its own type definitions.
nodeEngine	string	The Node.js versions the latest release supports.
unpackedSizeBytes	integer	How large the latest tarball is once unpacked.
fileCount	integer	How many files the latest tarball contains.
qualityScore	number	The registry's own quality component, 0 to 1.
popularityScore	number	The registry's own popularity component, 0 to 1.
maintenanceScore	number	The registry's own maintenance component, 0 to 1.
repositoryUrl	string	The package's source repository, normalised to an https URL.
homepageUrl	string	The homepage the package declares.
npmUrl	string	The package's page on npmjs.com.
retrievedAt	string	When this row was read from the registry, in UTC.

3 named dataset views ship with it: Packages, Supply chain, Health scores. They drive the Output tab in Console and the Output block on the Actor's .md page.

FAQ

Does it need an npm token? No. Everything it reads is the public registry, over plain HTTP, with no credential.

How many packages can one run return? Up to 5,000. Registry search pages at 250 per request and the actor pages through it automatically.

Are scoped packages supported? Yes - @types/node, @babel/core and so on, both in search results and as explicit names.

What is dependentCount? How many other packages on the registry declare a dependency on this one. It is the registry's own figure, not an estimate.

Why is version detail optional? It costs one extra registry request per package. Turn it off when you want a fast, shallow sweep of many packages, and on when you want publish history and dependency lists.

What is the stable identifier? packageName. It is the package's permanent registry address and the right key to join runs together over time.

---

Unofficial - not affiliated with npm, Inc. or GitHub. Collects public data only. reapx. Contact reapxdev@proton.me.

The full published archive

• npm package scraper archive — every entity this Actor has observed
• All reapx datasets — 20 sources, tens of thousands of pages
• llms.txt · feed.json · feed.xml — the machine-readable index, for agents

Each archive page carries Dataset JSON-LD, a canonical URL and the identifiers used, so an agent can resolve an entity without running anything. Nothing on those pages is estimated or modelled.

🧪 Example input

A real, runnable configuration — this is an actual input this Actor has run with.

{
  "searchQueries": [
    "@types"
  ],
  "includeVersionDetail": true,
  "requestsPerSecond": 5,
  "maxPackages": 250
}

📄 Sample output

One real row from a real run of this Actor, unedited.

{
  "packageName": "undici-types",
  "version": "8.9.0",
  "description": "A stand-alone types package for Undici",
  "keywords": [],
  "license": "MIT",
  "publisher": "GitHub Actions",
  "maintainers": [
    "matteo.collina",
    "ethan_arrowood"
  ],
  "maintainerCount": 2,
  "weeklyDownloads": 298359813,
  "monthlyDownloads": 1135621830,
  "dependentCount": 5085,
  "dependencies": [],
  "dependencyCount": 0,
  "devDependencyCount": 0,
  "versionCount": 129,
  "firstPublishedAt": "2023-09-19T15:09:35.360Z",
  "lastPublishedAt": "2026-07-24T12:55:33.657Z",
  "isDeprecated": false,
  "hasTypeScriptTypes": true,
  "nodeEngine": null,
  "unpackedSizeBytes": 120779,
  "fileCount": 48,
  "qualityScore": 1,
  "popularityScore": 1,
  "maintenanceScore": 1,
  "repositoryUrl": "https://github.com/nodejs/undici",
  "homepageUrl": "https://undici.nodejs.org",
  "npmUrl": "https://www.npmjs.com/package/undici-types",
  "retrievedAt": "2026-08-03T11:10:29Z"
}

How it works

1. You set the filters below, or none at all - every field is optional.
2. The Actor calls the public registry.npmjs.org API directly over HTTP. There is no key to obtain, no login and no headless browser, so a run is fast and cannot break on a UI change.
3. It pages through the results until your maximum is reached or the source runs out of matches.
4. Every row is pushed to the dataset as it is built - never buffered to the end. A run that hits its time limit still returns everything it collected.
5. You are charged package-returned at $0.002 per row, and nothing for Apify platform usage. The maximum-results field is therefore your cost cap, and Apify Store discounts apply on top.

💬 Your feedback

Found a bug, or need a field this does not return yet? Open an issue on the Actor's Issues tab, or write to reapxdev@proton.me. Bugs get fixed and reasonable field requests get added.

⚠️ Run outcomes and error handling

This Actor reports what happened in the run's status message, and it always keeps whatever it collected. These are the outcomes you can get and what each one means.

Outcome	What it means
Success	Rows were returned and you were charged package-returned at $0.002 per row.
No matches	The source returned nothing for your filters. Nothing is charged. Widen the date window or drop a filter.
Partial - source refused	The source rate-limited or refused some requests. The affected items are skipped and named in the log, and everything already collected is still pushed. A block never discards a run's work.
Oversized record	A single record exceeded the dataset item limit. It is reported and skipped rather than failing the run.

What is guaranteed either way

• Every row is pushed as it is built, not buffered to the end of the run. Anything that buffers output loses everything to a timeout, a block or a migration; this does not.
• A field absent from the source is absent from the row. Nothing is inferred, modelled or filled in to make a row look complete.

🧭 Ready-made configurations

These are saved, published configurations of this exact Actor. Open one and run it as it is, or copy its input as a starting point - each link is a live page with the full input and its output schema.

Configuration	Input
React npm Packages - Downloads & Deps	keyword: react; maxPackages: 250; requestsPerSecond: 5
Vue npm Packages - Downloads & Deps	keyword: vue; maxPackages: 250; requestsPerSecond: 5
Svelte npm Packages - Downloads & Deps	keyword: svelte; maxPackages: 250; requestsPerSecond: 5
CLI npm Packages - Downloads & Deps	keyword: cli; maxPackages: 250; requestsPerSecond: 5
Testing npm Packages - Downloads & Deps	keyword: testing; maxPackages: 250; requestsPerSecond: 5
TypeScript npm Packages - Downloads & Deps	keyword: typescript; maxPackages: 250; requestsPerSecond: 5
ESLint npm Packages - Downloads & Deps	keyword: eslint; maxPackages: 250; requestsPerSecond: 5
Webpack npm Packages - Downloads & Deps	keyword: webpack; maxPackages: 250; requestsPerSecond: 5
Bundler npm Packages - Downloads & Deps	keyword: bundler; maxPackages: 250; requestsPerSecond: 5
ORM npm Packages - Downloads & Deps	-
Database npm Packages - Downloads & Deps	-
GraphQL npm Packages - Downloads & Deps	-
HTTP Client npm Packages - Downloads & Deps	-
Logging npm Packages - Downloads & Deps	-

There are 49 of these in total, all listed on the Actor's Examples tab.