package-json
Advanced tools
Package description
The package-json npm package is used to fetch metadata about a package from the npm registry without needing to download the entire package. It can be used to get the latest version of a package, its dependencies, versions, and other useful metadata.
Get the latest version of a package
Fetches the latest version of the specified package from the npm registry.
{"packageJson": require('package-json'), "getLatestPackageVersion": async function(packageName) { const packageData = await packageJson(packageName); return packageData.version; }}Get metadata for a specific version of a package
Retrieves metadata for a specific version of a package, including dependencies, repository information, and more.
{"packageJson": require('package-json'), "getPackageDataForVersion": async function(packageName, version) { const packageData = await packageJson(packageName, {version: version}); return packageData; }}Get all versions of a package
Fetches a list of all available versions of a package from the npm registry.
{"packageJson": require('package-json'), "getAllVersions": async function(packageName) { const packageData = await packageJson(packageName, {allVersions: true}); return Object.keys(packageData.versions); }}Get the full metadata of a package
Retrieves the full metadata of a package, which includes additional information that's not part of the default output, such as deprecated versions and peerDependencies.
{"packageJson": require('package-json'), "getFullMetadata": async function(packageName) { const packageData = await packageJson(packageName, {fullMetadata: true}); return packageData; }}Similar to package-json, npm-registry-fetch is used to make requests to the npm registry. It provides more control over the HTTP requests, such as custom headers, but it's lower-level and requires more setup compared to package-json.
Pacote is a library that can fetch metadata and tarballs from npm. It's more feature-rich than package-json, offering manifest fetching, tarball extraction, and more. It's also used internally by npm CLI.
While not directly similar, registry-auth-token is often used in conjunction with packages like package-json to handle private packages that require authentication. It retrieves the auth token for the npm registry from the user's .npmrc file.
Readme
Get the package.json of a package from the npm registry
$ npm install --save package-json
const packageJson = require('package-json');
packageJson('pageres', 'latest').then(json => {
console.log(json);
//=> {name: 'pageres', ...}
});
// Also works with scoped packages
packageJson('@company/package', 'latest').then(json => {
console.log(json);
//=> {name: 'package', ...}
});
You can optionally specify a version (e.g. 1.0.0) or a dist tag such as latest. If you don't specify a version you'll get the main entry containing all versions.
The version can also be in any format supported by the semver module. For example:
1 - get the latest 1.x.x1.2 - get the latest 1.2.x^1.2.3 - get the latest 1.x.x but at least 1.2.3~1.2.3 - get the latest 1.2.x but at least 1.2.3Both public and private registries are supported, for both scoped and unscoped packages, as long as the registry uses either bearer tokens or basic authentication.
MIT © Sindre Sorhus
FAQs
Get metadata of a package from the npm registry
The npm package package-json receives a total of 6,531,700 weekly downloads. As such, package-json popularity was classified as popular.
We found that package-json demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A hospital in Mobile, Alabama, agreed to a settlement in a landmark ransomware death lawsuit, but is now reportedly reconsidering the agreement and refusing to pay.
Security News
A new report explores how advancements in LLMs are enhancing cyber threats, including polymorphic malware, personalized spearphishing, and the risk of hijacking customer service bots.
Security News
ESLint has approved an RFC that adds support for TypeScript configuration files, which is aimed at improving the developer experience and recognizing changes in the evolving JavaScript ecosystem.