Is there an npm API for package metadata and downloads?

Yes. Social Fetch has eighteen npm routes under /v1/npm for packages, full package documents, versions, single versions, downloads, per-version downloads, downloads for several names, advisories, provenance, dependents, search, users, orgs, package names, changes and recent updates. Authenticate with your Social Fetch API key in x-api-key.