# npm Package Metadata and Release Monitor > npm package metadata for up to 100 packages: latest version, release dates, license, repository, deprecation and weekly downloads. No npm token. URL: https://cliqtomedia.com/actors/npm-package-metadata-monitor/ Category: Developer & website monitoring · Status: coming soon · Apify profile: https://apify.com/cliqtomedia?fpr=cliqto List up to 100 npm packages and get one row for each. You see the latest version, release dates, license and weekly downloads. It also shows new releases since a date. ## How to use it: 3 steps 1. **Follow us on Apify.** The tool is built and waits in the queue for the Apify Store. Apify is the cloud platform where our tools run. 2. **Paste your input and press Start.** No code needed: you fill in a form (the input). It already has a working example. For example: `react` in npm packages. Each start is one run. 3. **Download the results.** When the run ends, the results are in a table (the dataset). Open Output, press Export and pick Excel or CSV. JSON and the API are there too. ## What it does Check up to 100 npm packages in one run and get one row per package: the `latest` dist-tag, the highest stable semver version, release dates, declared license, repository, maintainers count, deprecation and weekly downloads. The data comes from the public npm registry and the npm downloads API, with no login or API key. - `latestVersion` is the version the `latest` dist-tag points to. This is what `npm install ` installs. - `highestStableVersion` is the highest non-prerelease version by semver order. ### Good for - Watch your project's dependencies and see which ones had new releases since last week. - Build a table of packages with license, repository, maintainers count and deprecation. - Compare weekly downloads and release activity of several packages. ### Not a good fit - It is not a security scanner. It does not check vulnerabilities, malware or code. `latestHasProvenance` only says that npm has a build attestation for the latest version. - It does not verify licenses. `license` is what the package author declared. - It reads only the public npm registry. Private registries, GitHub Packages and other registries are not supported. - It does not resolve dependency trees and does not read your `package.json` or lock file. You list the package names. ## Price Prices will be shown after release. ## Questions ### Does it tell me if a package is safe? No. It is not a security scanner. Use our OSV vulnerability scanner for that. ### Can it read my package.json? No. You type the package names yourself. ### Does it work with private registries? No. It reads only the public npm registry. ### Why is latest lower than highest stable? The latest tag is set by the author. It can point to an older line on purpose. ### Do I need an npm account or token? No. The Actor reads only public data from the npm registry and the npm downloads API. ### Why is `latestVersion` lower than `highestStableVersion`? The `latest` dist-tag is set by the package authors. Sometimes they publish a new version for an old line, or they move `latest` back. `latestVersion` is what `npm install` gives you; `highestStableVersion` is the highest stable number. ### How fresh is the data? Each row is read from the registry during the run. `fetchedAt` shows when, and `sourceUpdatedAt` shows when the registry document last changed. ## Data fields - `input` (string): The entry as you typed it (before normalising links and version suffixes). - `packageName` (string): Exact npm package name that was looked up. null for invalid entries. - `status` (string): complete: all requested data; partial: metadata ok but weekly downloads missing (see error); not_found: npm has no such package (404) — not an error; unpublished: package existed but all versions were removed; invalid: not a valid npm name, no request made; error: lookup failed (see error). Only complete and partial rows are charged. - `npmUrl` (string): Package page on npmjs.com. - `registryUrl` (string): Registry document URL the data came from. - `description` (string): Package description from the registry (up to 2000 characters). - `latestVersion` (string): Version the latest dist-tag points to — what `npm install ` installs. Not necessarily the highest version; compare with highestStableVersion. - `distTags` (object): All dist-tags (latest, next, beta, canary…) and the versions they point to. - `highestStableVersion` (string): Highest published non-prerelease version by semver precedence. null when only prereleases exist. - `highestVersion` (string): Highest published version by semver precedence, prereleases included. - `latestIsHighestStable` (boolean): true when latestVersion equals highestStableVersion; false when the latest tag lags behind (or points to a prerelease); null when unknown. - `versionsCount` (integer): Number of published versions currently in the registry. - `prereleaseVersionsCount` (integer): How many of those versions are prereleases (or not valid semver). - `deprecatedVersionsCount` (integer): How many versions carry a deprecation message. - `createdAt` (string): When the package was first published (ISO 8601, UTC). - `modifiedAt` (string): When the registry document last changed (any version, tag or metadata). - `latestPublishedAt` (string): When the latestVersion was published. - `lastReleaseAt` (string): Newest publish time of any version, prereleases included. - `lastStableReleaseAt` (string): Newest publish time of a stable (non-prerelease) version. - `daysSinceLastRelease` (integer): Whole days since lastStableReleaseAt (since lastReleaseAt when includePrereleases is on). null when unknown. - `license` (string): License of the latest version as declared (usually an SPDX expression, e.g. MIT or (MIT OR Apache-2.0)). Not verified against the code. null when not declared. - `repositoryUrl` (string): Source repository normalised to an https URL (credentials and .git removed). null when not declared or not a web URL. - `repositoryRaw` (string): Repository value exactly as declared in package.json. - `repositoryDirectory` (string): Subdirectory inside a monorepo, when declared. - `homepage` (string): Homepage declared by the latest version. - `bugsUrl` (string): Issue tracker URL declared by the latest version. - `maintainersCount` (integer): Number of npm accounts listed as maintainers. Names and emails are not output. - `deprecated` (boolean): true when the latest version is deprecated by its author. - `deprecationMessage` (string): Author's deprecation message for the latest version. - `latestHasProvenance` (boolean): true when the latest version was published with an npm provenance attestation. A signal of build origin, not a security verdict. - `latestDependenciesCount` (integer): Number of runtime dependencies of the latest version (dependencies only, not dev/peer). - `latestUnpackedSize` (integer): Unpacked size of the latest version in bytes, when the registry reports it. - `nodeEngine` (string): engines.node range of the latest version, e.g. ">= 18". - `weeklyDownloads` (integer): Downloads in the last full week from the npm downloads API. 0 means zero downloads; null means unknown (turned off or the downloads API failed). - `downloadsPeriod` (object): Date range (start, end) the weeklyDownloads count covers. - `recentReleases` (array): Newest versions with publish dates, newest first (maxRecentReleases items; prereleases only with includePrereleases). - `newReleases` (array): Versions published since the baseline (sinceDate or previous run with the same monitorKey), newest first. [] means none; null means no baseline yet (first monitored run) or no baseline requested. - `newReleasesCount` (integer): Number of items in newReleases. null when there is no baseline. - `baselineKind` (string): What newReleases is compared with: snapshot (previous run with the same monitorKey), sinceDate, initial (first monitored run for this package), none (no monitoring requested). - `baselineAt` (string): Baseline time: the newest publish time seen in the previous run, or sinceDate. ## Input settings - `packages` (array, required): Up to 100 unique npm package names per run, e.g. react, @types/node. npmjs.com/package/... links and name@version also work (the version part is ignored). Names are case-sensitive; exact repeats are removed. Invalid names get a free row with status "invalid". - `includePrereleases` (boolean): Include prerelease versions (canary, beta, rc, next…) in recentReleases, newReleases and daysSinceLastRelease. highestStableVersion always ignores prereleases. - `sinceDate` (string): Report versions published on or after this date in newReleases, e.g. 2026-10-01 (UTC) or an ISO date-time. Leave empty to skip. With monitorKey, packages already in the snapshot are compared with the previous run instead. - `monitorKey` (string): Any name, e.g. my-app-deps. The Actor remembers what it saw under this key (in a named key-value store in your account) and the next run reports only versions published since then. The first run is the baseline (newReleases null). Letters, digits, - and _ only. - `onlyNewReleases` (boolean): With sinceDate or monitorKey: write only packages that have new releases (and packages seen for the first time under monitorKey, as the baseline). Unchanged packages are checked for a smaller fee and not written. Not found, invalid and failed packages are still listed for free. - `includeDownloads` (boolean): Add last-week download counts from the npm downloads API. If that API fails, metadata is still returned with weeklyDownloads null and status "partial". - `maxRecentReleases` (integer): How many of the newest versions (with publish dates) to list in recentReleases. 0 turns the list off. ## Step by step on Apify 1. Open the Input tab. 2. In npm packages (`packages`), keep the prefilled names (`react`, `express`, `lodash`, `@types/node`, `typescript`) or add your own. 3. Keep the other settings as they are. 4. Click Start. 5. Open the Output tab and check the Packages view: `latestVersion`, `highestStableVersion`, `license` and `weeklyDownloads`. ## Use cases | Task | Input | Key fields | Next step | |---|---|---|---| | Weekly dependency release check | `packages`, `monitorKey`, `onlyNewReleases` | `newReleases`, `latestVersion`, `deprecated` | Send the Dataset to Slack or email with an Apify integration | | "What changed since our last upgrade?" | `packages`, `sinceDate` | `newReleases`, `latestIsHighestStable` | Plan upgrades | | Package inventory | `packages` | `license`, `repositoryUrl`, `maintainersCount`, `deprecated` | Export to CSV or Excel | | Compare packages | `packages` | `weeklyDownloads`, `daysSinceLastRelease`, `versionsCount` | Sort in a spreadsheet | ## Tips - Run it every week and send the results to Slack or email. - Look at both latest and highest stable version. They can be different. - Check the deprecation field. It shows packages you should replace. ## Limits - Up to 100 unique packages per run. For more, start several runs. - The Actor stops its own work at about 4 minutes of a 5-minute default timeout. In tests, 100 large packages (React, TypeScript, AWS SDK and others) took 53 seconds. - A safety limit of 120 MB applies to each registry document; a bigger document gives a row with status `error` and code `SOURCE_TOO_LARGE`. The largest documents we tested (about 31 MB, packages like `next` and `aws-sdk`) took a few seconds each. - If the npm downloads API fails, package rows are still written with `weeklyDownloads: null` and status `partial`. - If the npm registry fails or does not answer, the Actor retries a few times and then stops asking. The rest of the packages are listed as skipped, and the run summary status is `PARTIAL` or `ERROR`. These rows are not charged. - Download counts are npm's own numbers and can change after the week ends. ## Sample result ```json { "input": "express", "packageName": "express", "status": "complete", "npmUrl": "https://www.npmjs.com/package/express", "registryUrl": "https://registry.npmjs.org/express", "description": "Fast, unopinionated, minimalist web framework", "latestVersion": "5.3.0", "distTags": { "latest": "5.3.0", "latest-4": "4.22.3" }, "highestStableVersion": "5.3.0", "highestVersion": "5.3.0", "latestIsHighestStable": true, "versionsCount": 290, "prereleaseVersionsCount": 43, "deprecatedVersionsCount": 173, "createdAt": "2010-12-29T19:38:25.450Z", "modifiedAt": "2026-10-09T12:56:55.078Z", "latestPublishedAt": "2026-10-09T12:56:54.505Z", "lastReleaseAt": "2026-10-09T12:56:54.505Z", "lastStableReleaseAt": "2026-10-09T12:56:54.505Z", "daysSinceLastRelease": 3, "license": "MIT", "repositoryUrl": "https://github.com/expressjs/express", "repositoryRaw": "git+https://github.com/expressjs/express.git", "repositoryDirectory": null, "homepage": "https://expressjs.com/", "bugsUrl": "https://github.com/expressjs/express/issues", "maintainersCount": 5, "deprecated": false, "deprecationMessage": null, "latestHasProvenance": true, "latestDependenciesCount": 28, "latestUnpackedSize": 76638, "nodeEngine": ">= 18", "weeklyDownloads": 144987450, "downloadsPeriod": { "start": "2026-10-05", "end": "2026-10-11" }, "recentReleases": [ { "version": "5.3.0", "publishedAt": "2026-10-09T12:56:54.505Z", "isPrerelease": false, "deprecated": false }, { "version": "4.22.3", "publishedAt": "2026-09-14T06:46:38.631Z", "isPrerelease": false, "deprecated": false } ], "newReleases": null, "newReleasesCount": null, "baselineKind": "none", "baselineAt": null, "unpublishedAt": null, "provider": "npm public registry (registry.npmjs.org) and npm downloads API (api.npmjs.org)", "fetchedAt": "2026-10-12T14:34:04.374Z", "sourceUpdatedAt": "2026-10-09T12:56:55.078Z", "error": null } ``` ## Similar tools - [Software End-of-Life Checker](https://cliqtomedia.com/actors/software-end-of-life-checker/) - [Link Route Audit — Bulk HTTP Status & Redirects](https://cliqtomedia.com/actors/bulk-url-status-redirect-checker/) - [GitHub Releases Monitor & Scraper](https://cliqtomedia.com/actors/github-releases-monitor-scraper/) - [Dependency Vulnerability Scanner (OSV)](https://cliqtomedia.com/actors/osv-dependency-vulnerability-scanner/) - [GitHub Repositories & Users Search (No Login)](https://cliqtomedia.com/actors/github-search/) - [OpenAPI Catalog & Breaking Change Detector](https://cliqtomedia.com/actors/openapi-spec-catalog-diff/)