npm Has a Free Security Advisory API — Find Vulnerable Packages Before They Break Your App

Last month, a popular npm package with 10M+ weekly downloads got compromised. Teams scrambled to check if their projects were affected. Most used npm audit — but that only catches known vulnerabilities in your lockfile. What if you could programmatically check ANY package for security issues, track its download trends, and monitor its dependency chain — all through free APIs? You can. Here are 4 npm-related APIs that most developers don't know exist. 1. npm Registry API — Package Metadata Without Auth The npm registry itself is a CouchDB instance with a public REST API: // Get full package metadata const response = await fetch ( ' https://registry.npmjs.org/express ' ); const data = await response . json (); console . log ( `Latest version: ${ data [ ' dist-tags ' ]. latest } ` ); console . log ( `Total versions: ${ Object . keys ( data . versions ). length } ` ); console . log ( `License: ${ data . license } ` ); console . log ( `Weekly downloads: check api.npmjs.org` ); No API key. N