Unpkg
unpkg is a fast, free CDN that serves any package published to npm directly from its registry. ScanMalware detects it from unpkg.com asset URLs.
Serving code straight from npm is convenient but is a real supply-chain dependency — the site trusts whatever the package currently resolves to. Verifying loaded files against known-good fingerprints guards against a tampered dependency.
Commonly deployed alongside Unpkg
Of the 6,206 public scans where Unpkg was detected, these are the technologies most often present on the same site. The share is the percentage of Unpkg sites that also ran each one.
| Technology | Category | Share of Unpkg sites |
|---|---|---|
| Google Analytics | wappalyzer | 63.74% |
| HTTP/3 | wappalyzer | 50.73% |
| Ubuntu | wappalyzer | 34.4% |
| Node.js | wappalyzer | 33.16% |
| Express | wappalyzer | 32.92% |
| Open-Graph-Protocol | miscellaneous | 32.1% |
| jQuery | wappalyzer | 30.15% |
| Cloudflare | wappalyzer | 27.96% |
| JQuery | miscellaneous | 22.86% |
| Google Tag Manager | wappalyzer | 20.16% |
| HSTS | wappalyzer | 18.59% |
| Cloudflare Bot Management | wappalyzer | 16.6% |
| jsDelivr | wappalyzer | 15.98% |
| PoweredBy | miscellaneous | 15.03% |
How ScanMalware detects Unpkg
Unpkg is detected by analysing the response headers, HTML markup, JavaScript runtime and asset URLs captured when ScanMalware loads the site in a real headless browser.
From any scan you can pivot into related signals — JARM TLS fingerprints, ASN ownership and BGP routing, certificate history, JavaScript analysis and the overall security verdict — to understand not just that Unpkg is present, but how it is being used. Open the full search interface for Unpkg →
Recent public scans featuring Unpkg
A rolling sample of recent public scans where Unpkg was detected. Listing a site here is not a safety judgement — open a scan to see its full verdict.
| Site | Scanned |
|---|---|
| Ministry of Urban Development http://www.moud.gov.np | 2026-06-15 |
| Creating Safe, Comfortable Homes in London | Notting Hill Genesis http://www.pcha.org.uk | 2026-06-15 |
| Influencer Marketing Basics | Pixly https://www.pixly.tv/services/influencer-marketing | 2026-06-15 |
| What is Influencer Marketing? | Mavely https://www.joinmavely.com/blog/what-is-influencer-marketing/ | 2026-06-15 |
| 纸上战争 - 回合制战略游戏 https://paperwar-dpvmn02f28u4.edgeone.app/ | 2026-06-15 |
| Glasgow Subway, Bus and Ticket information | SPT | Strathclyde Partnership for Transport http://www.spt.co.uk | 2026-06-15 |
| Lamezia Multiservizi S.p.a. | Servizi sostenibili per la colletività https://www.lameziamultiservizi.it | 2026-06-15 |
| Home - Clare Hall http://www.clarehall.cam.ac.uk | 2026-06-15 |
Frequently asked questions about Unpkg
- Does using Unpkg mean a website is unsafe?
- No. Unpkg is a stack component, not a verdict. ScanMalware scores the whole page — its scripts, redirects, certificates, threat-intelligence matches and behaviour — so a site using Unpkg can be perfectly safe or actively malicious.
- How many sites using Unpkg has ScanMalware scanned?
- Unpkg has been detected in 6,206 public scans on ScanMalware.com. Each scan is a real headless-browser visit, and the figure updates as new URLs are submitted.
- What technologies are commonly used with Unpkg?
- Across scanned sites, Unpkg is most often seen alongside Google Analytics, HTTP/3 and Ubuntu. The full co-occurrence breakdown is listed on this page.
Browse all profiled technologies on the technology index, or scan a URL to see its full stack.