npm Has a Free Security Advisory API — Find Vulnerable Packages Before They Break Your App

// Get full package metadata
const response = await fetch('https://registry.npmjs.org/express');
const data = await response.json();

console.log(`Latest version: ${data['dist-tags'].latest}`);
console.log(`Total versions: ${Object.keys(data.versions).length}`);
console.log(`License: ${data.license}`);
console.log(`Weekly downloads: check api.npmjs.org`);

// Daily downloads for last month
const res = await fetch('https://api.npmjs.org/downloads/point/last-month/express');
const data = await res.json();
console.log(`${data.package}: ${data.downloads.toLocaleString()} downloads last month`);

// Compare packages
const packages = ['express', 'fastify', 'koa', 'hapi'];
for (const pkg of packages) {
    const r = await fetch(`https://api.npmjs.org/downloads/point/last-month/${pkg}`);
    const d = await r.json();
    console.log(`${pkg}: ${d.downloads.toLocaleString()}`);
}
// express:    35,234,567
// fastify:     4,891,234  
// koa:         1,234,567
// hapi:          456,789

// Downloads per day for a specific range
const url = 'https://api.npmjs.org/downloads/range/2025-01-01:2025-03-24/react';
const res = await fetch(url);
const data = await res.json();

// Plot the trend
data.downloads.forEach(d => {
    const bar = '#'.repeat(Math.floor(d.downloads / 500000));
    console.log(`${d.day} | ${bar} ${d.downloads.toLocaleString()}`);
});

// Search advisories for a package
const query = `
{
  securityAdvisories(first: 5, orderBy: {field: PUBLISHED_AT, direction: DESC}, ecosystem: NPM) {
    nodes {
      summary
      severity
      publishedAt
      vulnerabilities(first: 3) {
        nodes {
          package { name }
          vulnerableVersionRange
          firstPatchedVersion { identifier }
        }
      }
    }
  }
}`;

// Use via GitHub GraphQL API (needs token for GraphQL, but REST is free)
// Or use the REST endpoint:
const res = await fetch('https://api.github.com/advisories?ecosystem=npm&per_page=5');
const advisories = await res.json();
advisories.forEach(a => {
    console.log(`[${a.severity}] ${a.summary}`);
    console.log(`  Published: ${a.published_at}`);
});

// How much will this package add to your bundle?
const res = await fetch('https://bundlephobia.com/api/size?package=lodash@latest');
const data = await res.json();

console.log(`${data.name}@${data.version}`);
console.log(`  Size: ${(data.size / 1024).toFixed(1)} KB`);
console.log(`  Gzipped: ${(data.gzip / 1024).toFixed(1)} KB`);
console.log(`  Download time (3G): ${data.downloadTime}ms`);

const alternatives = ['lodash', 'underscore', 'ramda', 'remeda'];
for (const pkg of alternatives) {
    const r = await fetch(`https://bundlephobia.com/api/size?package=${pkg}@latest`);
    const d = await r.json();
    console.log(`${pkg}: ${(d.gzip / 1024).toFixed(1)} KB gzipped`);
}
// lodash:      25.2 KB
// underscore:   7.1 KB
// ramda:       12.4 KB
// remeda:       5.8 KB

async function packageHealthCheck(name) {
    console.log(`n=== Health Check: ${name} ===n`);

    // 1. Basic metadata
    const meta = await (await fetch(`https://registry.npmjs.org/${name}`)).json();
    const latest = meta['dist-tags'].latest;
    console.log(`Latest: ${latest}`);
    console.log(`Versions: ${Object.keys(meta.versions).length}`);
    console.log(`License: ${meta.license}`);

    // 2. Downloads
    const dl = await (await fetch(`https://api.npmjs.org/downloads/point/last-month/${name}`)).json();
    console.log(`Downloads/month: ${dl.downloads.toLocaleString()}`);

    // 3. Bundle size
    try {
        const size = await (await fetch(`https://bundlephobia.com/api/size?package=${name}@latest`)).json();
        console.log(`Bundle size: ${(size.gzip / 1024).toFixed(1)} KB gzipped`);
    } catch(e) {
        console.log('Bundle size: N/A');
    }

    // 4. Dependencies count
    const deps = meta.versions[latest].dependencies || {};
    console.log(`Dependencies: ${Object.keys(deps).length}`);

    // 5. Last publish date
    const time = meta.time[latest];
    const daysSince = Math.floor((Date.now() - new Date(time)) / 86400000);
    console.log(`Last published: ${time.split('T')[0]} (${daysSince} days ago)`);

    if (daysSince > 365) console.log('  ⚠️  WARNING: Not updated in over a year');
    if (Object.keys(deps).length > 20) console.log('  ⚠️  WARNING: Heavy dependency tree');
}

packageHealthCheck('express');