pumpcheck

Check whether an npm package's public download count reflects real adoption. Detects 'download pumping' -- the documented supply-chain technique where a package is published in hundreds of rapid-fire versions so registry mirrors and security scanners inflate its download counter, making an unused or malicious package look popular. Returns npm's headline 30-day count, a spike-resistant estimate of sustained real usage, the share of the month falling on the busiest single day, recent version-flood bursts, and a verdict of clean, unreliable or inflated. Use before adding or recommending a dependency, especially a new or unfamiliar one. This free check does one package per call; auditing a whole package.json or package-lock.json in one pass is a separate $299 product at https://www.edgethirteen.com/tools/pumpcheck.

{'type': 'object', 'required': ['package'], 'properties': {'package': {'type': 'string', 'description': 'The npm package name, e.g. express or @upstash/context7-mcp.'}}}