UNPKG — The CDN for everything on npm

Global edge: Served from Cloudflare's network, close to browsers everywhere. Network
11 origin regions: Files are fetched from origin machines across the Americas, Europe, Asia, and Australia.
Verified bytes: Every file is digest-checked before it is cached, and corrupt entries heal themselves.
Supply-chain defense: UNPKG Shield pins or swaps compromised packages at the edge.

Start in one line

Point a script tag at a package file. Pin the full version in production so the response comes straight from the edge cache:

<script src="https://unpkg.com/preact@10.26.4/dist/preact.min.js"></script>

In a module, load the browser-ready build from esm.unpkg.com:

<script type="module">
  import React from "https://esm.unpkg.com/react@18.3.1";
</script>

Need to know what's inside a package first? Append ?meta to any package URL for JSON metadata.

Ways to use UNPKG

Load files from npm: any file, any package, one URL. Versions, entry points, and exports resolution explained.
Build apps with no build step: import maps turn a plain HTML file into a working app.
Use native browser modules: esm.unpkg.com converts packages into modules browsers load directly.
Run inline TypeScript and JSX: the /run helper transforms inline scripts in the page.
Inspect packages programmatically: file listings, sizes, and integrity hashes as JSON, for tools and agents.

<script type="module" src="https://unpkg.com/run"></script>
<script type="text/ts">
  import confetti from "canvas-confetti";
  confetti({ particleCount: 80, spread: 70 });
</script>

Running in production

Exact-version files are cached at the edge for a year, and every cached byte is digest-verified. A damaged entry is evicted and refetched, never served. If a version has to be withdrawn, it can be evicted from every cache layer without touching any other version. The network page explains how, and the status page describes how changes ship safely.

Serving production traffic through UNPKG? UNPKG Shield (currently in Beta) watches every npm release as it publishes. Arm a domain and a compromised version is pinned to the last known-good release (or blocked) at the edge, before a browser executes it. How supply-chain defense works.

Open source

UNPKG is an open source project, free to use, and not affiliated with npm. The guides go deeper on everything above.