Get npm package
Get an npm package's latest version, every dist-tag, publisher, dependencies and last week's downloads.
Headers
Get your API keyAPI key (`sfk_...`)
npm package name, e.g. `express`, `lodash.merge`, `@types/node` or `--file--1`. Names are case-sensitive (`Express` is a different package) and keep legacy punctuation such as a leading `-`.
max 214 chars
Endpoint-specific response payload.
Whether the item exists. Every outcome is HTTP 200; branch on this field.
one of: found, not_found
Every dist-tag.
The version the `latest` dist-tag points at.
The latest version when found; otherwise null.
Package name, as the registry stores it.
Package scope including `@`, or null for an unscoped name.
Version.
Description.
Keywords.
Licence: an SPDX expression/string or the published object.
Project homepage.
Issue tracker URL.
Source repository.
Repository type, e.g. `git`.
Repository URL as published.
Monorepo directory the package was published from.
Author.
Author name.
Author URL.
Contributors.
Contributor name.
Contributor URL.
GitHub handle the publisher listed.
Maintainers at the time this version was published. The details route uses the package's current maintainer list instead.
Maintainer username.
Publisher of this version.
Publishing username.
The CI identity, when the version was published by one.
Trusted publisher kind, e.g. `github`.
The publisher's OIDC configuration id.
Who approved a trusted publication.
Approving username.
Funding channels.
Funding kind, e.g. `opencollective`.
Funding URL.
Deprecation message; null when the version is not deprecated.
Whether `preinstall`, `install` or `postinstall` is defined, inferred from `scripts` when the field is absent. Null when neither the field nor those scripts are present: an implicit node-gyp rebuild from binding.gyp cannot be seen.
Command-name to file map, or null when the package has no binaries.
The package's entrypoints.
`main` entrypoint.
`module` entrypoint.
`types` or `typings` entrypoint.
`type` field (`module` or `commonjs`).
The `exports` map, as published.
`files` patterns.
The `sideEffects` flag, when published as a boolean.
Engine constraints.
Supported operating systems.
Supported CPU architectures.
Workspace patterns.
Package scripts.
Runtime dependencies.
Development dependencies.
Peer dependencies.
Peer dependency metadata.
Optional dependencies.
Bundled dependencies, as an array or the legacy boolean.
The published artifact and its registry metadata.
Tarball URL.
SHA-1 of the tarball.
Subresource-integrity hash of the tarball.
Files in the tarball.
≥ 0
Unpacked bytes.
≥ 0
Registry signatures. The legacy PGP block is not exposed.
Signing key id.
Signature.
Whether this version was published with provenance.
Whether the version carries an attestation.
Predicate type of the provenance attestation.
Git commit the version was built from.
The publisher's toolchain, from the version document.
Node version used to publish.
npm CLI version used to publish.
How the package ships TypeScript types: bundled with it, or through a DefinitelyTyped `@types` package.
one of: bundled, definitelyTyped, null
Last week's downloads, when available.
Downloads in the last week.
≥ 0
`YYYY-MM-DD`, or null when npm has none.
`YYYY-MM-DD`, or null when npm has none.
False when part of the answer could not be filled (dist-tags or last week's downloads); `missing` says which.
Parts of the answer that could not be filled.
Metadata describing the request and billing outcome.
Unique request identifier for tracing this API call.
min 1 chars
Credits charged for this request.
≥ 0
Public API version that served the response.
one of: v1
Code example
curl "https://api.socialfetch.dev/v1/npm/package?name=express" \
-H "x-api-key: YOUR_API_KEY"Responses
npm package.