registry VS flags

More important than the namespace is who published the package. I'm more inclined to trust an individual I know who takes security than a namespace that may change hands.

NPM exposes that info in the _npmUser field: https://github.com/npm/registry/blob/master/docs/REGISTRY-AP.... That gives "name" (NPM username) and email.

While there are thousands of packages, I bet there's a much smaller number of publishers to worry about.

I can't find anything about it in their docs. https://github.com/npm/registry/blob/master/docs/REGISTRY-API.md

https://github.com/npm/registry/blob/master/docs/REGISTRY-API.md here are the docs. I was getting 122ms responses instead of 9000 on the old one.

My first instinct was to work with the public API of the npm registry. This sounds like a very good idea, but you will soon run into a set of problems (cache, private registry etc..).

There is no need to obtain an API key or token for querying NPM registry API. For the dashboard, I use only the endpoint that provides the data about a package downloads count - https://api.npmjs.org/downloads/. You can read more about it here.

While many people regularly use npm's website to discover packages, only a few know that npm also provides a public REST API accessible at registry.npmjs.org.

Or roll your own, docs here: https://github.com/npm/registry/blob/master/docs/download-counts.md

This also explains why in NodeSecure we have a "hasCustomResolver" flag allowing quick identification of packages using resolutions to dependencies that diverge from the usual.