# npm License & Deprecation Checker (`taroyamada/npm-package-intelligence`) Actor

Audit npm libraries for deprecated versions, abandoned repositories, and specific open-source licenses to maintain healthy JavaScript supply chains.

- **URL**: https://apify.com/taroyamada/npm-package-intelligence.md
- **Developed by:** [naoki anzai](https://apify.com/taroyamada) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $8.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## NPM Package Intelligence API | Downloads, Dependencies & Licenses

Audit public npm libraries for deprecated versions, abandoned repositories, and specific open-source licenses to guarantee a secure software supply chain. This specialized npm license scraper and deprecation checker enables engineering teams and compliance officers to systematically evaluate third-party JavaScript dependencies. Rather than manually inspecting individual repository web pages, you can run bulk scans across your entire dependency tree to extract actionable metadata directly from the official npm platform. Users frequently deploy this tool to enforce corporate compliance policies, ensuring that no unauthorized licenses slip into production codebases. It is also an essential asset for identifying abandoned packages that lack recent updates or have active deprecation flags, which often signal impending security vulnerabilities. Running this scraper on a weekly schedule empowers teams to maintain automated watchlists and catch risky dependencies before they are merged. Each execution yields highly detailed, structured results, featuring the exact open-source license, deprecation status, author contact details, direct dependency arrays, repository URLs, and current weekly download stats. Automate your open-source governance, extract critical security details, and eliminate the blind spots in your node modules using precision data extraction tools.

### Store Quickstart

- Start with 3–5 exact package names in `packages` for the cleanest first run.
- Add `searchTerm` only when you need discovery, and keep `searchSize` around 10–20 until you know the category you want.
- Use `dryRun: true` to validate webhook or dataset delivery before a larger audit.
- After the first useful run, move the account to the recurring watchlist template, then use the webhook handoff template for release alerts or downstream actions.

### Key Features

- 📦 **Full package metadata** — version, description, author, homepage, repo
- 📥 **Weekly download stats** — Usage signal for popularity
- 🔗 **Dependencies tree** — Direct deps with version specs
- ⚖️ **License info** — MIT, Apache-2.0, GPL-3.0 detection
- ⚠️ **Deprecation detection** — Flags deprecated packages
- 🔑 **No API key needed** — Uses official npm registry

### Use Cases

| Who | Why |
|-----|-----|
| **DevOps teams** | Dependency security audits |
| **Engineering leaders** | Track tech stack across projects |
| **OSS maintainers** | Competitor package analysis |
| **License compliance** | Verify all deps are commercially usable |
| **Recruiters/founders** | Research packages/maintainers for hiring |

### Input

| Field | Type | Default | Description |
|-------|------|---------|-------------|
| packages | string\[] | (required) | npm package names (max 100) |
| includeDownloads | boolean | true | Weekly download stats |
| includeDeprecated | boolean | false | Include deprecated warnings |

#### Input Example

```json
{
  "packages": ["express", "react", "axios"],
  "includeDownloads": true,
  "includeDeprecated": false
}
```

### Input Examples

#### Example: Single-target audit

```json
{
  "targets": [
    "example-target-1"
  ],
  "maxResultsPerTarget": 30
}
```

#### Example: Bulk portfolio

```json
{
  "targets": [
    "target-1",
    "target-2",
    "target-3"
  ],
  "maxResultsPerTarget": 50,
  "snapshotKey": "npm-package-intelligence-state"
}
```

#### Example: Recurring delta watch

```json
{
  "targets": [
    "target-1"
  ],
  "snapshotKey": "npm-package-intelligence-state",
  "emitChangedOnly": true
}
```

### Output

| Field | Type | Description |
|-------|------|-------------|
| `name` | string | Package name |
| `version` | string | Latest version |
| `description` | string | Package description |
| `downloads` | object | Download stats by period (if includeDownloads) |
| `downloads.lastWeek` | integer | Last 7 days downloads |
| `downloads.lastMonth` | integer | Last 30 days downloads |
| `vulnerabilities` | object\[] | Known CVEs (if includeVulnerabilities) |
| `maintainers` | string\[] | Maintainer usernames |
| `license` | string | SPDX license identifier |
| `repository` | string | Source repo URL |

#### Output Example

```json
{
  "name": "express",
  "version": "4.21.2",
  "description": "Fast, unopinionated web framework",
  "author": "TJ Holowaychuk",
  "license": "MIT",
  "dependencies": {"body-parser": "~1.20.0"},
  "weeklyDownloads": 32000000,
  "deprecated": false
}
```

### API Usage

Run this actor programmatically using the Apify API. Replace `YOUR_API_TOKEN` with your token from [Apify Console → Settings → Integrations](https://console.apify.com/account/integrations).

#### cURL

```bash
curl -X POST "https://api.apify.com/v2/acts/taroyamada~npm-package-intelligence/run-sync-get-dataset-items?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "packages": ["express", "react", "axios"], "includeDownloads": true, "includeDeprecated": false }'
```

#### Python

```python
from apify_client import ApifyClient

client = ApifyClient("YOUR_API_TOKEN")
run = client.actor("taroyamada/npm-package-intelligence").call(run_input={
  "packages": ["express", "react", "axios"],
  "includeDownloads": true,
  "includeDeprecated": false
})

for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)
```

#### JavaScript / Node.js

```javascript
import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_API_TOKEN' });
const run = await client.actor('taroyamada/npm-package-intelligence').call({
  "packages": ["express", "react", "axios"],
  "includeDownloads": true,
  "includeDeprecated": false
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);
```

### Tips & Limitations

- Audit your dependency list monthly to catch new CVEs and abandoned packages.
- Track competitor packages' download trends for market intel.
- Combine with GitHub data for full open-source intelligence.
- Use in CI/CD to fail builds when vulnerabilities are introduced.

### FAQ

**Where do download stats come from?**

npm's official npms.io API. Weekly counts are reliable popularity signals.

**Can I get security vulnerability data?**

Not directly. Pair with npm audit or Snyk for security scanning.

**Does it work with private packages?**

No — only public npm registry. Private packages require authentication.

**Deprecated packages?**

Flagged via the 'deprecated' field. Useful for migration planning.

**Where do vulnerabilities come from?**

GitHub Advisory Database via the npm audit endpoint.

**Are private npm packages supported?**

Public packages only. Private registries require authentication that this actor doesn't handle.

### Related Actors

Pair this actor with other flagship intelligence APIs in the same portfolio:

- [PyPI Package Intelligence API](https://apify.com/taroyamada/pypi-package-intelligence) — audit Python packages with release history, dependency declarations, and optional OSV signals.
- [Docker Hub Image Intelligence API](https://apify.com/taroyamada/dockerhub-image-intelligence) — inspect public container repositories, tags, pulls, and star signals for supply-chain research.
- [Shopify Store Intelligence API](https://apify.com/taroyamada/shopify-store-intelligence) — add public storefront and catalog context when evaluating ecommerce stacks built on these packages.

### Pricing & Cost Control

Apify Store pricing is usage-based, so total cost mainly follows how many packages you process and whether you also run discovery via `searchTerm`. Check the Store pricing card for the current per-event rates.

- Start with a short `packages` list or keep `searchSize` small for discovery runs.
- Turn `includeDownloads` on only when popularity signals matter.
- Use `dryRun: true` to validate the input before larger audits.
- Prefer dataset delivery while iterating; switch to webhooks once the payload shape is stable.

### ⭐ Was this helpful?

If this actor saved you time, please [**leave a ★ rating**](https://apify.com/taroyamada/npm-package-intelligence/reviews) on Apify Store. It takes 10 seconds, helps other developers discover it, and keeps updates free.

Bug report or feature request? Open an issue on the [Issues tab](https://apify.com/taroyamada/npm-package-intelligence/issues) of this actor.

# Actor input Schema

## `packages` (type: `array`):

npm package names to look up (max 100). Scoped packages supported (e.g. @scope/name).

## `searchTerm` (type: `string`):

Optional keyword to search the npm registry (registry.npmjs.org/-/v1/search). Leave blank to skip search.

## `searchSize` (type: `integer`):

Maximum number of search results to return (1–250).

## `includeDownloads` (type: `boolean`):

Include download statistics (last-day, last-week, last-month) from api.npmjs.org.

## `concurrency` (type: `integer`):

Number of parallel package requests.

## `timeoutMs` (type: `integer`):

Request timeout in milliseconds.

## `delivery` (type: `string`):

Where to send results: Apify dataset or webhook URL.

## `webhookUrl` (type: `string`):

Webhook URL to POST results to (only used when delivery=webhook).

## `dryRun` (type: `boolean`):

Parse input and fetch data but do not push to dataset or call webhook.

## Actor input object example

```json
{
  "packages": [
    "express",
    "react"
  ],
  "searchSize": 20,
  "includeDownloads": true,
  "concurrency": 5,
  "timeoutMs": 15000,
  "delivery": "dataset",
  "dryRun": false
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "express",
        "react"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("taroyamada/npm-package-intelligence").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packages": [
        "express",
        "react",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("taroyamada/npm-package-intelligence").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "express",
    "react"
  ]
}' |
apify call taroyamada/npm-package-intelligence --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,taroyamada/npm-package-intelligence"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/ivMEyrWq3gHHTquzb/builds/qjiiwupMhIX1INnqA/openapi.json