lookup_npm_package
Get a behavioral commitment profile for any npm package. Returns real signals that prove genuine investment: package age, download volume and trend (growing/stable/declining), release consistency, npm publisher count, GitHub contributor count, and linked GitHub activity.
Also returns publisherLifecycle — cross-referencing current maintainers against per-version publish history to flag dormant publishers who still hold npm scope access. The Mastra incident (June 2026) exploited exactly this: a contributor dormant since 2024 with never-revoked scope access.
Why behavioral signals matter: download counts, stars, and READMEs can be gamed. Download trend consistency and publisher depth over years are harder to fake. Supply chain attacks often target packages with low publisher depth (few people with npm publish access).
Useful for: vetting dependencies before installation, due diligence on open-source packages, identifying abandonware, checking if a package is actively maintained.
Examples: "langchain", "@anthropic-ai/sdk", "express", "litellm"
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes | npm package name. Examples: "langchain", "@anthropic-ai/sdk", "express". Scoped packages need the @ prefix. |