UNPKG — The CDN for everything on npm

Global edge: Served from Cloudflare's network, close to browsers everywhere. Network
11 origin regions: Files are fetched from origin machines across the Americas, Europe, Asia, and Australia.
Verified bytes: Every file is digest-checked before it is cached, and corrupt entries heal themselves.
Supply-chain defense: UNPKG Shield pins or swaps compromised packages at the edge.

Start in one line

Point a script tag at a package file. Pin the full version in production so the response comes straight from the edge cache:

<script src="https://unpkg.com/preact@10.26.4/dist/preact.min.js"></script>

In a module, load the browser-ready build from esm.unpkg.com:

<script type="module">
  import React from "https://esm.unpkg.com/react@18.3.1";
</script>

Need to know what's inside a package first? Append ?meta to any package URL for JSON metadata.

Ways to use UNPKG

Load files from npm: any file, any package, one URL. Versions, entry points, and exports resolution explained.
Build apps with no build step: import maps turn a plain HTML file into a working app.
Use native browser modules: esm.unpkg.com converts packages into modules browsers load directly.
Run inline TypeScript and JSX: the /run helper transforms inline scripts in the page.
Inspect packages programmatically: file listings, sizes, and integrity hashes as JSON, for tools and agents.

<script type="module" src="https://unpkg.com/run"></script>
<script type="text/ts">
  import confetti from "canvas-confetti";
  confetti({ particleCount: 80, spread: 70 });
</script>

UNPKG, inside your AI agent

Agents are bad at recalling npm: versions that don't exist, files that were never published. The UNPKG MCP server gives your agent live resolution, real file listings, project audits, and import-map validation — so it builds direct UNPKG file lookups from facts, and tells you when a framework should keep its bundle instead.

It also checks what you're about to ship. Ask about any dependency — or your whole project — and it answers with exact-version malware verdicts and CVE checks, including the version to upgrade to. No account is needed for packages you name; connect a Shield account and it does the same for everything your domains actually serve, ranked by your traffic.

"Is lodash@4.17.20 safe to load? Check it for malware and CVEs."

"Audit my project, and check every dependency for known compromises before converting anything."

Connect your agent

Running in production

Exact-version files are cached at the edge for a year, and every cached byte is digest-verified. A damaged entry is evicted and refetched, never served. If a version has to be withdrawn, it can be evicted from every cache layer without touching any other version. The network page explains how, and the status page describes how changes ship safely.

Serving production traffic through UNPKG? UNPKG Shield (currently in Beta) watches every npm release as it publishes. Arm a domain and a compromised version is pinned to the last known-good release (or blocked) at the edge, before a browser executes it. How supply-chain defense works.

Open source

UNPKG is an open source project, free to use, and not affiliated with npm. The guides go deeper on everything above.