npm

class

NpmRegistry

purl type

pkg:npm

api

registry.npmjs.org

version status

deprecated

Address it

await fetchPackageFromPURL("pkg:npm/lodash");
await fetchPackageFromPURL("pkg:npm/%40vue/core"); // scoped, encoded
await fetchPackageFromPURL("pkg:npm/@vue/core"); // scoped, as typed

The scope is the PURL namespace, @ included. fullName joins it back to @vue/core, which the adapter encodes as %40vue%2Fcore on the way to the registry.

Or construct the class yourself:

import { Client, NpmRegistry } from "@agntn/registries";

const npm = new NpmRegistry("https://registry.npmjs.org", new Client());
const pkg = await npm.fetchPackage("@vue/core");

What it reads

latestVersion is dist-tags.latest. The license comes from the package document, or the latest version when the document has none, and can be a string or an object with a type.

Versions

publishedAt comes from the time map. integrity is the version's dist.integrity (sha512-…), falling back to sha1- plus the shasum. A version with a deprecated message has status: "deprecated".

Dependencies

A name listed under both dependencies and optionalDependencies appears once, as optional.

Maintainers

Maintainers come first with an empty role, then the latest version's author with role: "author" and its contributors with role: "contributor", deduplicated by name and email. Each carries whatever name, email and url npm has.

URLs

urls.registry("lodash"); // https://www.npmjs.com/package/lodash
urls.registry("lodash", "4.18.1"); // https://www.npmjs.com/package/lodash/v/4.18.1
urls.download("@vue/core", "3.5.0"); // https://registry.npmjs.org/@vue%2Fcore/-/core-3.5.0.tgz
urls.readme("lodash", "4.18.1"); // https://cdn.jsdelivr.net/npm/lodash@4.18.1/README.md

Gotchas

• The full package document for a package with thousands of versions is megabytes. fetchVersions and fetchMaintainers both read it; put a cache in front if you call them repeatedly.
• documentation is always empty; npm has no separate docs field. resolveDocsUrl falls back to the homepage, then to the npmjs.com page.
• A mirror such as registry.npmmirror.com works through the repository_url qualifier, as long as it serves the same document shape.

Where it lives

src/registries/npm.ts, the largest adapter and the template for new ones.