Download websites that use Unpkg

About Unpkg

A script tag pasted out of a readme is how Unpkg arrives on most of the sites carrying it. A developer needed a library running in a browser within the next few minutes, pointed a tag at a public mirror of the package registry, and the tag survived into production because it kept working. Nobody signed anything, nobody filed a ticket, and nothing about that sequence involves a decision anyone would defend in a review.

The consequence is a request to an outside origin on every page load, in the render path, under no contract. The service is free, offered under MIT terms and operated as a public convenience, which means there is no support agreement, no uptime commitment and no procurement record inside the company that depends on it. Security reviewers and vendor risk teams care about exactly that shape of dependency, and it rarely shows up in an internal asset inventory because nobody ever filed it.

Presence also says something about how the site is built. A page pulling libraries straight from a registry mirror is a page that either has no build pipeline or has one the marketing team routes around. The pattern clusters around prototypes promoted to production, documentation sites, campaign landing pages and content themes where an editor pasted a widget snippet. Since 2016 the service has been the standard way library authors write the install line in a readme, so it propagates by copying examples rather than by adoption in any deliberate sense.

As of September 2026 we detect Unpkg on 1,521,516 sites, United States accounts for 696,405 of them and the suffix mix leans toward .com. Geography again follows hosting and registration rather than the nationality of the developer who pasted the tag.

The honest caveat here concerns resolution. We record that a page requests assets from the origin, not which package it requests or whether the request pins a version. Two domains counted identically may be loading a small utility and an entire framework, and one of them may be resolving to a floating tag that returns different code next month. There is no version field on this technology for that reason. Detection also depends on the URL appearing in served markup, so anything bundled at build time or proxied through the site own domain is invisible to us and the total should be read as a floor.

A per-domain lookup tells a reviewer about one site, which is fine when the question is about one site. The downloadable list answers questions a lookup cannot reach. How many domains in a sector, a country or a customer base carry an uncontracted third party in the critical render path. Which hosting environments concentrate the pattern. Whether the population is growing or draining as build tooling gets easier, which only becomes visible by comparing one snapshot against another. For vendors selling build pipelines, self-hosting or supply chain monitoring, that population is the addressable market rather than a curiosity.