Check P9 · provenance family · severity HIGH · automatic · one of the 12 npm and PyPI package checks
Maps to OWASP LLM03 ATLAS AML.T0111 Stars, downloads or installs that do not match the project's history: the trust signal is the product, not a by-product.
The question this check asks: is this package popular faster than it is old? A package two weeks old with tens of thousands of weekly downloads is either the launch of the month or a number someone made.
A download count is the first thing a reader sees and one of the easiest things to manufacture: a script that installs a package in a loop raises it. The repository roster reads the same shape as star velocity, and the skill roster as installs against age, for the same reason — the trust signal is the product, not a by-product.
On npm the weekly download count is read from npm's own downloads service. pkg-traction-mismatch is HIGH and 15 points when the package has 10,000 downloads or more in the last week and was first published less than 14 days ago. The finding prints both figures. A HIGH is a warning under the default profile, never a block on its own.
On PyPI this check is skipped: PyPI publishes no download count in the JSON this roster reads, and the check does not guess one. The skip is listed on the report and never withholds a PASS, because there is nothing for it to read on that registry. On npm, a downloads service that did not answer is a partial scan, and P9 is listed as not checked.
A launch that went well, or a new package pulled in by a popular one — a dependency of something widely used is downloaded as often as its parent from its first day. The finding prints the count and the age so the reader is judging numbers, and an override records the reason.
PyPI downloads. None are published in the record read. Downloads bought after the window. Fourteen days is the window in which a large number cannot honestly be organic for most packages; after it the check no longer fires. What the package does. A popular package and a malicious one can be the same package; the number is a reason to look. The package's code is not read.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else; a package named on the line (npm install express, pip install flask, npx, npm create) is judged by its own verdict under this roster, its declared repository riding along. Direct dependencies named on the command line only; transitive dependencies and lockfiles are not resolved. A package added by editing package.json or requirements.txt and installed later is not a line the hook judges. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. This roster reads what npmjs.org and pypi.org publish about a package — its record, its release history, its declared repository — and never the package's code or what it installs after it. A registry other than those two (a --registry or --index-url on the line) is asked about, not assessed. A package the registry no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s https://api.npmjs.org/downloads/point/last-week/NAME
npm view NAME time.createdThen look at who depends on it — the package's page on npmjs.com lists its dependents: a new package used by a well-known one explains its numbers; a new package used by nothing does not.
Why is PyPI a skip? Because PyPI does not publish a download count in the project JSON this roster reads. The check does not guess a number it cannot fetch; the skip is listed on the report and is never a pass.
What are the thresholds? 10,000 or more downloads in the last week on a package first published less than 14 days ago. Both are policy values, printed here so a reader can hold the product to them.
Why does a popular new package warn? Because the count is the easiest trust signal to manufacture, and in its first two weeks a package has had little time to earn it honestly. A new package pulled in by a popular parent will fire too; the finding prints both figures so the reader can see which case it is.
P6 Package age · C3 Star velocity and traction · S3 Traction mismatch.
Add RepoGates to Chrome Pricing
Sources for this page: the thresholds and weights from the product's own roster and scoring tables.