# npm passes the 1 millionth package milestone! What can we learn? — Liran Tal

June 4th is a historic date where the millionth package was indexed into the npm registry. npm is a package manager for JavaScript packages.

Canonical: https://lirantal.com/blog/2019-06-04_npm-passes-1-million-packages

June 4th is a historic date where the millionth package was indexed into the npm registry. npm is a package manager for JavaScript packages.

We wanted to share some insights that we thought are interesting and could get our hands on

## What are npm’s most popular packages? how many vulnerabilities are associated with them?

Here are the top 3

*   lodash: 3 vulnerabilities (1 high sev)
*   request: 1 vulnerability (17 typosquatting attempts)
*   chalk 0 vulnerabilities: (1 typosquatting attempt)

## How many downloads do the top 10 packages pull in?

*   debug: >40 million weekly downloads
*   kind-of: >34 million weekly downloads
*   supports-color: >34 million weekly downloads

There’s a [more detailed article](https://snyk.io/blog/npm-passes-the-1-millionth-package-milestone-what-can-we-learn) on other registry and community statistics such as how many npm packages were added in 2019? As well as what are some interesting insights from the Node.js Foundation’s package maintenance working group.

## More writing

[All writing →](/blog)

*   Sep 5, 2026

    ### [Self-Hosting Hermes Agent with Matrix E2EE on Proxmox](/blog/self-host-hermes-agent-matrix-e2ee-proxmox)

*   Aug 2, 2026

    ### [The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph](/blog/practical-second-brain-llm-markdown-knowledge-graph)

*   Aug 1, 2026

    ### [Building a Second Brain with LLMs and AI Agents](/blog/building-second-brain-llms-ai-agents)


* * *

Liran Tal is the author of the book [Node.js Secure Coding: Defending Against Command Injection Vulnerabilities](https://www.nodejs-security.com/)

[Start Building Secure Node.js Applications ↗](https://www.nodejs-security.com/)

 [![](/_astro/nodejs-secure-coding-book-3d-style.DiTWpzFs_Z3c7s1.png)](https://www.nodejs-security.com/)