# npm.io

> Health, security and popularity reports for every npm package: a 0–100 health score with its reasons, known vulnerabilities (own and in direct dependencies), weekly downloads, TypeScript and module-format support, dependency tree, version history, README and suggested alternatives.

Every package has a page at `https://npm.io/package/<name>` (scoped packages: `https://npm.io/package/@scope/name`). Each page has a Markdown twin at the same URL with `.md` appended — the same facts and the raw README as plain GitHub-flavoured Markdown, no HTML. Prefer the `.md` form when you are an agent or a crawler: it is smaller, stable, and links dependencies and alternatives as `.md` too.

Pages of packages that have not been analysed yet show the indexed metadata (version, description, license, downloads, links) and fill in the full report within minutes of the first visit.

## Package pages (Markdown)

- [lodash](https://npm.io/package/lodash.md)
- [underscore](https://npm.io/package/underscore.md)
- [ramda](https://npm.io/package/ramda.md)
- [immer](https://npm.io/package/immer.md)
- [date-fns](https://npm.io/package/date-fns.md)
- [dayjs](https://npm.io/package/dayjs.md)
- [moment](https://npm.io/package/moment.md)
- [luxon](https://npm.io/package/luxon.md)
- [uuid](https://npm.io/package/uuid.md)
- [nanoid](https://npm.io/package/nanoid.md)
- [react](https://npm.io/package/react.md)
- [react-dom](https://npm.io/package/react-dom.md)

## Programmatic access
- [OpenAPI reference](https://api.npm.io/docs): REST API — `GET https://api.npm.io/v1/package/<name>` returns the full health report as JSON, `/versions`, `/downloads`, `/vulnerabilities`, `/alternatives` and more per package.

- [Sitemap index](https://npm.io/sitemaps/root.xml): every indexed package with its last publish date as lastmod.

## Optional

- Search is at `https://npm.io/search/<query>` (interactive use; disallowed for crawling in robots.txt because the URL space is unbounded).
- Version-specific pages (`/package/<name>/v/<version>`) are variants of the package page and are disallowed for crawling; use the package page or its `.md` twin.