Search code examples
javascriptnode.jsnpmpackagerisk-analysis

Determine NPM package's source url from npmjs.org's registry?

Is there a way to determine a NPM package's source repository URL? Looking at the https://registry.npmjs.org API it doesn't point to the source for the package?

Am trying to figure out how to work back from a dependent package to the source for it - possibly in some automated way. Anyone have any insight they can share?

For example the npmjs.org page for react:

React's package at NPM

Clearly shows the "Repository" link. But the "registry" doesn't include this information. I want to get that Github url to https://github.com/facebook/react from the API/CouchDB database.

UPDATE: Have discovered that the "package" API does indeed provide data I am looking for.

curl https://replicate.npmjs.com/react | jq

Returns:

...
"repository": {
    "type": "git",
    "url": "git+https://github.com/facebook/react.git",
    "directory": "packages/react"
  }
...

But curl https://replicate.npmjs.com/_all_docs\?include_docs\=true -o npm.full.json doesn't include that info.

Solution

  • The answer is that API that provides this info is the package directly:

    curl https://replicate.npmjs.com/react | jq