Data sources and methodology

npm Registry

Metadata, versions, publication dates, dependency requirements, licenses, and distribution files.

Bundlephobia

Version-pinned package measurements; peer dependencies may be excluded.

deps.dev

Generic-environment resolved graphs, direct advisory references, repository observations, and dated OpenSSF Scorecard checks.

npm Downloads

All-version download counts; automation and transitive installs are included.

Maintainer documentation

Linked capability claims with explicit conditions; current documentation is not applied to historical releases.

Cache policy

Latest metadata and release indexes refresh every 30 minutes, direct advisories every 15 minutes, repository signals every 6 hours, graphs and pinned manifests daily, download history every 12 hours, and pinned bundle measurements every 30 days. Expired snapshots remain labeled stale while revalidation runs. Failed providers use a retry delay.

Attribution

deps.dev-generated data: CC BY 4.0. Wikipedia discovery seed: revision 1379415690, CC BY-SA 4.0. Keyword research supplies discovery aliases, not technical claims.