npm Package Metadata & Release Monitor

packageName	express
npmUrl	https://www.npmjs.com/package/express
registryUrl	https://registry.npmjs.org/express

How it will work: 3 steps

Follow us on ApifyThe tool is built and waits in the queue for the Apify Store. Apify is the cloud platform where our tools run.
Paste your input and press StartNo code needed: you fill in a form (the input). It already has a working example. For example: react in npm packages. Each start is one run.
Download the resultsWhen the run ends, the results are in a table (the dataset). Open Output, press Export and pick Excel or CSV. JSON and the API are there too.

This tool is an Apify Actor: a small program that runs on Apify. You can also run it on a schedule, for example every Monday. New to it? Read how it works, step by step and the 8 words you need first.

Made by Cliqto Media, an independent digital media company. We made this tool. About us

What it does

Check up to 100 npm packages in one run and get one row per package: the latest dist-tag, the highest stable semver version, release dates, declared license, repository, maintainers count, deprecation and weekly downloads. The data comes from the public npm registry and the npm downloads API, with no login or API key.

latestVersion is the version the latest dist-tag points to. This is what npm install <name> installs.
highestStableVersion is the highest non-prerelease version by semver order.

Good for

Watch your project's dependencies and see which ones had new releases since last week.
Build a table of packages with license, repository, maintainers count and deprecation.
Compare weekly downloads and release activity of several packages.

Not a good fit

It is not a security scanner. It does not check vulnerabilities, malware or code. latestHasProvenance only says that npm has a build attestation for the latest version.
It does not verify licenses. license is what the package author declared.
It reads only the public npm registry. Private registries, GitHub Packages and other registries are not supported.
It does not resolve dependency trees and does not read your package.json or lock file. You list the package names.

Who uses it

Development teams

See which dependencies had new releases since your last upgrade.

Tech leads

Build a package table with license, repository and deprecation.

Open source watchers

Compare weekly downloads and release activity of several packages.

Price

Prices will be shown after release.

Questions

Does it tell me if a package is safe?

No. It is not a security scanner. Use our OSV vulnerability scanner for that.

Can it read my package.json?

No. You type the package names yourself.

Does it work with private registries?

No. It reads only the public npm registry.

Why is latest lower than highest stable?

The latest tag is set by the author. It can point to an older line on purpose.

Do I need an npm account or token?

No. The Actor reads only public data from the npm registry and the npm downloads API.

Why is latestVersion lower than highestStableVersion?

The latest dist-tag is set by the package authors. Sometimes they publish a new version for an old line, or they move latest back. latestVersion is what npm install gives you; highestStableVersion is the highest stable number.

How fresh is the data?

Each row is read from the registry during the run. fetchedAt shows when, and sourceUpdatedAt shows when the registry document last changed.

Details

Step by step on Apify

Open the Input tab.
In npm packages (packages), keep the prefilled names (react, express, lodash, @types/node, typescript) or add your own.
Keep the other settings as they are.
Click Start.
Open the Output tab and check the Packages view: latestVersion, highestStableVersion, license and weeklyDownloads.

Use cases

Task	Input	Key fields	Next step
Weekly dependency release check	`packages`, `monitorKey`, `onlyNewReleases`	`newReleases`, `latestVersion`, `deprecated`	Send the Dataset to Slack or email with an Apify integration
"What changed since our last upgrade?"	`packages`, `sinceDate`	`newReleases`, `latestIsHighestStable`	Plan upgrades
Package inventory	`packages`	`license`, `repositoryUrl`, `maintainersCount`, `deprecated`	Export to CSV or Excel
Compare packages	`packages`	`weeklyDownloads`, `daysSinceLastRelease`, `versionsCount`	Sort in a spreadsheet

Tips for better results

Run it every week and send the results to Slack or email.
Look at both latest and highest stable version. They can be different.
Check the deprecation field. It shows packages you should replace.

Limits and good to know

Up to 100 unique packages per run. For more, start several runs
The Actor stops its own work at about 4 minutes of a 5-minute default timeout. In tests, 100 large packages (React, TypeScript, AWS SDK and others) took 53 seconds
A safety limit of 120 MB applies to each registry document; a bigger document gives a row with status error and code SOURCE_TOO_LARGE. The largest documents we tested (about 31 MB, packages like next and aws-sdk) took a few seconds each
If the npm downloads API fails, package rows are still written with weeklyDownloads: null and status partial
If the npm registry fails or does not answer, the Actor retries a few times and then stops asking. The rest of the packages are listed as skipped, and the run summary status is PARTIAL or ERROR. These rows are not charged
Download counts are npm's own numbers and can change after the week ends

For developers

Sample result

One result from a real test run, in JSON. Real values change from run to run. In Excel or CSV each field is a column.

one result · JSON

{
  "input": "express",
  "packageName": "express",
  "status": "complete",
  "npmUrl": "https://www.npmjs.com/package/express",
  "registryUrl": "https://registry.npmjs.org/express",
  "description": "Fast, unopinionated, minimalist web framework",
  "latestVersion": "5.3.0",
  "distTags": { "latest": "5.3.0", "latest-4": "4.22.3" },
  "highestStableVersion": "5.3.0",
  "highestVersion": "5.3.0",
  "latestIsHighestStable": true,
  "versionsCount": 290,
  "prereleaseVersionsCount": 43,
  "deprecatedVersionsCount": 173,
  "createdAt": "2010-12-29T19:38:25.450Z",
  "modifiedAt": "2026-10-09T12:56:55.078Z",
  "latestPublishedAt": "2026-10-09T12:56:54.505Z",
  "lastReleaseAt": "2026-10-09T12:56:54.505Z",
  "lastStableReleaseAt": "2026-10-09T12:56:54.505Z",
  "daysSinceLastRelease": 3,
  "license": "MIT",
  "repositoryUrl": "https://github.com/expressjs/express",
  "repositoryRaw": "git+https://github.com/expressjs/express.git",
  "repositoryDirectory": null,
  "homepage": "https://expressjs.com/",
  "bugsUrl": "https://github.com/expressjs/express/issues",
  "maintainersCount": 5,
  "deprecated": false,
  "deprecationMessage": null,
  "latestHasProvenance": true,
  "latestDependenciesCount": 28,
  "latestUnpackedSize": 76638,
  "nodeEngine": ">= 18",
  "weeklyDownloads": 144987450,
  "downloadsPeriod": { "start": "2026-10-05", "end": "2026-10-11" },
  "recentReleases": [
    { "version": "5.3.0", "publishedAt": "2026-10-09T12:56:54.505Z", "isPrerelease": false, "deprecated": false },
    { "version": "4.22.3", "publishedAt": "2026-09-14T06:46:38.631Z", "isPrerelease": false, "deprecated": false }
  ],
  "newReleases": null,
  "newReleasesCount": null,
  "baselineKind": "none",
  "baselineAt": null,
  "unpublishedAt": null,
  "provider": "npm public registry (registry.npmjs.org) and npm downloads API (api.npmjs.org)",
  "fetchedAt": "2026-10-12T14:34:04.374Z",
  "sourceUpdatedAt": "2026-10-09T12:56:55.078Z",
  "error": null
}

Data fields (40)

Field	Type	Meaning
`input`	string	The entry as you typed it (before normalising links and version suffixes).
`packageName`	string	Exact npm package name that was looked up. null for invalid entries.
`status`	string	complete: all requested data; partial: metadata ok but weekly downloads missing (see error); not_found: npm has no such package (404) — not an error; unpublished: package existed but all versions were removed; invalid: not a valid npm name, no request made; error: lookup failed (see error). Only complete and partial rows are charged.
`npmUrl`	string	Package page on npmjs.com.
`registryUrl`	string	Registry document URL the data came from.
`description`	string	Package description from the registry (up to 2000 characters).
`latestVersion`	string	Version the latest dist-tag points to — what `npm install <name>` installs. Not necessarily the highest version; compare with highestStableVersion.
`distTags`	object	All dist-tags (latest, next, beta, canary…) and the versions they point to.
`highestStableVersion`	string	Highest published non-prerelease version by semver precedence. null when only prereleases exist.
`highestVersion`	string	Highest published version by semver precedence, prereleases included.
`latestIsHighestStable`	boolean	true when latestVersion equals highestStableVersion; false when the latest tag lags behind (or points to a prerelease); null when unknown.
`versionsCount`	integer	Number of published versions currently in the registry.
`prereleaseVersionsCount`	integer	How many of those versions are prereleases (or not valid semver).
`deprecatedVersionsCount`	integer	How many versions carry a deprecation message.
`createdAt`	string	When the package was first published (ISO 8601, UTC).
`modifiedAt`	string	When the registry document last changed (any version, tag or metadata).
`latestPublishedAt`	string	When the latestVersion was published.
`lastReleaseAt`	string	Newest publish time of any version, prereleases included.
`lastStableReleaseAt`	string	Newest publish time of a stable (non-prerelease) version.
`daysSinceLastRelease`	integer	Whole days since lastStableReleaseAt (since lastReleaseAt when includePrereleases is on). null when unknown.
`license`	string	License of the latest version as declared (usually an SPDX expression, e.g. MIT or (MIT OR Apache-2.0)). Not verified against the code. null when not declared.
`repositoryUrl`	string	Source repository normalised to an https URL (credentials and .git removed). null when not declared or not a web URL.
`repositoryRaw`	string	Repository value exactly as declared in package.json.
`repositoryDirectory`	string	Subdirectory inside a monorepo, when declared.
`homepage`	string	Homepage declared by the latest version.
`bugsUrl`	string	Issue tracker URL declared by the latest version.
`maintainersCount`	integer	Number of npm accounts listed as maintainers. Names and emails are not output.
`deprecated`	boolean	true when the latest version is deprecated by its author.
`deprecationMessage`	string	Author's deprecation message for the latest version.
`latestHasProvenance`	boolean	true when the latest version was published with an npm provenance attestation. A signal of build origin, not a security verdict.
`latestDependenciesCount`	integer	Number of runtime dependencies of the latest version (dependencies only, not dev/peer).
`latestUnpackedSize`	integer	Unpacked size of the latest version in bytes, when the registry reports it.
`nodeEngine`	string	engines.node range of the latest version, e.g. ">= 18".
`weeklyDownloads`	integer	Downloads in the last full week from the npm downloads API. 0 means zero downloads; null means unknown (turned off or the downloads API failed).
`downloadsPeriod`	object	Date range (start, end) the weeklyDownloads count covers.
`recentReleases`	array	Newest versions with publish dates, newest first (maxRecentReleases items; prereleases only with includePrereleases).
`newReleases`	array	Versions published since the baseline (sinceDate or previous run with the same monitorKey), newest first. [] means none; null means no baseline yet (first monitored run) or no baseline requested.
`newReleasesCount`	integer	Number of items in newReleases. null when there is no baseline.
`baselineKind`	string	What newReleases is compared with: snapshot (previous run with the same monitorKey), sinceDate, initial (first monitored run for this package), none (no monitoring requested).
`baselineAt`	string	Baseline time: the newest publish time seen in the previous run, or sinceDate.

Input settings (7)

The main fields of the input form. With the API you send them as JSON.

Setting	Name in the API	Type	Example value
npm packages required	`packages`	array	`["react", "express", "lodash", "@types/node", "typescript"]`
Include prereleases	`includePrereleases`	boolean	`false`
New releases since date	`sinceDate`	string
Monitor key (compare with previous run)	`monitorKey`	string
Only output packages with new releases	`onlyNewReleases`	boolean	`false`
Include weekly downloads	`includeDownloads`	boolean	`true`
Recent releases per package	`maxRecentReleases`	integer	`10`

npm Package Metadata and Release Monitor

How it will work: 3 steps