npm Registry API
Public REST API and CouchDB-based registry for the npm JavaScript package ecosystem. Provides package metadata lookup, version history, download statistics, search, and package manifest access. Also supports publishing packages and managing user/org scopes via authenticated endpoints. The download counts API tracks package popularity over time.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Granular access tokens with IP allow-lists improve supply chain security. 2FA enforcement for publish operations on high-value packages is supported. The public registry has had historical supply chain attacks (typosquatting, account takeovers) — consumers should validate package integrity via checksums. npm audit uses a separate Advisory database, not the registry API.
⚡ Reliability
Best When
You need to programmatically look up package metadata, versions, or download statistics for JavaScript/Node.js packages, especially for dependency analysis, security scanning, or developer tooling.
Avoid When
You need to host private packages, require guaranteed SLAs on the registry, or are building against the full CouchDB replication API which is no longer publicly supported.
Use Cases
- • Fetching package metadata (description, versions, dependencies, license, maintainers) for dependency analysis tools
- • Building security audit pipelines that enumerate transitive dependencies and check for known vulnerabilities
- • Tracking download trends for packages to measure adoption or compare alternatives
- • Automating package publication and tagging workflows in CI/CD pipelines via npm publish API
- • Building registry mirrors, caching proxies, or private registry federations on top of the public registry
Not For
- • High-frequency automated queries at scale without caching — the registry has rate limits and bans abusive crawlers
- • Private package hosting for proprietary code (use GitHub Packages, Verdaccio, or Artifactory instead)
- • Non-JavaScript ecosystems — use PyPI, crates.io, or Maven Central for other language packages
Interface
Authentication
Read-only registry queries (package metadata, download counts) are unauthenticated. Publishing, deprecating, and team management require npm access tokens. Tokens are scoped: read-only, automation (publish without 2FA), and publish (requires 2FA or TOTP). Granular access tokens (GATs) introduced in 2022 support IP allow-lists and package-specific scope.
Pricing
Reading public package data and download stats is completely free. Private packages require a paid plan. The registry itself has no explicit published rate limits for reads, but aggressive scraping results in IP bans. Use the replicate endpoint or bulk download APIs for large-scale analysis.
Agent Metadata
Known Gotchas
- ⚠ The `dist-tags` field in package metadata (e.g., `latest`) is the authoritative resolved version for `npm install package` — agents that parse the full versions list and sort semantically may get a different result than what npm actually installs if the maintainer has set a non-latest dist-tag
- ⚠ Package names are case-insensitive in the registry but canonical names are lowercase — querying `Express` returns data but the canonical package is `express`; always normalize to lowercase before lookups
- ⚠ The download counts API (api.npmjs.org/downloads) is a separate service from registry.npmjs.org and uses a different base URL; agents that try to fetch download stats from the registry URL will get 404s
- ⚠ Scoped packages (@org/package) must be URL-encoded in API paths — `@scope/name` becomes `%40scope%2Fname`; forgetting the encoding returns 404 even for packages that exist
- ⚠ The `time` field in package manifests contains publish timestamps for every version but uses ISO 8601 with milliseconds — some JSON parsers that coerce dates may lose sub-second precision
- ⚠ npm's registry has eventually consistent mirrors — immediately after publishing, some CDN edge nodes may return a 404 for the new version for up to 30 seconds; build retry logic into publish verification steps
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for npm Registry API.
Scores are editorial opinions as of 2026-03-06.