Companies Using unpkg

unpkg is a mirror of npm with a URL scheme: ask for any file in any package and it serves it. That makes it easy to detect and hard to interpret, because the interesting question is who picked it. In our October 2026 crawl, 710,077 domains loaded a file from unpkg or its old name, npmcdn.com, and we matched 401,142 to a company. It ranks 7th of the 60 CDNs we track. On 12 October I checked a random sample and our top 50 in a browser, and pulled the package names from the script addresses our crawler kept.

What a detection means

Our rule counts a page that loads a script from unpkg.com or npmcdn.com, or carries a link element pointing at unpkg.com. That link check also matches a bare preconnect hint, so I tested it. Of 120 live domains drawn at random, 104 loaded and still referenced unpkg. 99 of those referenced a real file; 5 carried only a preconnect or dns-prefetch hint. On one of the five, a caching plugin had copied Meta's script locally and left the hint behind. Thirteen blocked automated visits or didn't load, and three no longer referenced unpkg at all. Nokia's home page was hint-only too, so I took it out of our company list.

Sales signal: about 95% of readable unpkg hits are real files. Treat the count as sites that run a library from npm without bundling it.

Growth trajectory

The count went from 511,455 in June to 710,077 in October. 124,234 of that came in July alone, and the three months since added 74,388. Most of that step is our side: the set of domains we crawl turns over every month, with dead sites dropping out and newly found ones added, and our detection signals widen over time. Since March 2026, 123,775 domains have dropped unpkg; in a recount about one in ten still load it on another hostname.

"I'd bet many unpkg site owners couldn't tell you they use it. The link came with a snippet from somebody else's README." - David Thomson, CTO at TechnologyChecker.io

Sales signal: don't read the curve as momentum. A site's unpkg link lives and dies with the library it loads, not with a purchasing decision.

Who actually chose unpkg

Of 14,488 domains where we kept an unpkg script address, 10,006 had a readable package name. 2,386 load one of David DeSandro's libraries: imagesLoaded (808), Isotope (653), Flickity (641) and Masonry (284). Their documentation links unpkg, and his Metafizzy blog says he moved every Metafizzy CDN link from cdnjs to unpkg in 2016. flatpickr leads single packages with 1,392, AOS has 595 and its official site lists unpkg as the CDN source, and 428 load Meta's Conversions API helper, which on every site I checked was added by the Meta for WooCommerce plugin. Google's web-vitals README uses unpkg in its examples too. Old habits show as well: 4,920 of the 14,488 still request files from npmcdn.com, the pre-rename address, which now redirects.

Sales signal: the decision-maker is often a library author or a plugin vendor, not the site's developer. If you sell performance or security work, the pitch is "you're loading code from a third party you never chose".

Who loads it

56.64% of matched companies with a known size have 1 to 10 employees and 82.15% have 50 or fewer. The base is young: 59.38% were founded in 2010 or later, against a jQuery CDN base where 15.13% date from the 2020s. Above 1,000 staff there are 7,692 companies. In our top 50, 20 load unpkg on the main site, including T-Mobile, Chipotle, Kaiser Permanente and Mars, and nine on careers sites such as Disney's, Sanofi's and AXA's. Eight, T-Mobile, Scotiabank, RBC and JLR among them, load Google's web-vitals script from unpkg to measure page speed.

Sales signal: an enterprise hit is usually one helper file, such as an animation player or a speed meter. That's an opening for web-performance and front-end governance vendors, not proof of a front-end platform.

Where and in which sectors

The United States has 101,547 matched companies, then the United Kingdom (31,405) and India (24,409). France is 4th with 21,902, 5.46% of matched companies, against 16,922 (3.68% of 460,026) on the jQuery CDN's profile. No sector dominates: Retail 4.72%, Real Estate 4.43%, IT Services 3.97%, and the ten largest sectors add up to 31.47%.

Sales signal: France over-indexes on unpkg compared with the jQuery CDN. Agencies and hosts selling in French have a deeper list here than the CDN's size suggests.

Side by side with jsDelivr and cdnjs

No pair passed our switching tests. Today 247,857 domains load both unpkg and cdnjs, 236,383 unpkg and jsDelivr, and 80,647 unpkg and the jQuery CDN. For every pair, at least 80% of the domains ever seen with both still load both. jsDelivr serves the same npm catalogue and runs a page that converts unpkg links.

"Count the CDN hostnames on a page and you get a rough record of every plugin and snippet added over the years. On unpkg sites, cdnjs is often on that list." - David Thomson, CTO at TechnologyChecker.io

Sales signal: stacked CDNs mean extra DNS lookups and connections before a page renders. Sites loading three or more make an easy audit list.

What it costs

Nothing. unpkg.com calls itself an open-source project from Michael Jackson, not affiliated with npm, running on Cloudflare Workers. Kent C. Dodds' introduction describes it as sponsored by Cloudflare and passes on its creator's advice: if your business depends on a file, pay for a host with uptime guarantees. unpkg's metadata API returns an integrity hash for every file, yet only 3 of the 85 sampled sites whose HTML linked an unpkg file used one.

Sales signal: there's no unpkg budget to win. Sell the self-hosting and bundling work, and the monitoring that tells a team when a third-party file fails.

Key takeaways

1. 710,077 domains, 7th of 60 CDNs with 3.39%, only 21,395 ahead of Hostinger CDN's 688,682.

2. 99 of 104 readable sampled pages referenced a real unpkg file; 5 had only a preconnect hint.

3. Library docs and plugins choose unpkg: DeSandro's libraries alone account for 2,386 of 10,006 sampled sites.

4. 82.15% of matched companies have 50 staff or fewer, and the base is younger than the jQuery CDN's.

5. 247,857 domains load unpkg and cdnjs together. Library CDNs stack.

Working with the list

Filter to companies with 11 to 200 staff, then open the site and read the package from the script address. A plain opener for a performance agency: "Your carousel loads from unpkg on every page view; bundling it removes a third-party dependency and a connection." For security vendors, the enterprise hostnames are the target, because a public CDN file on a careers or main site may sit outside the main release process. The full list of 710,077 unpkg domains, with company and stack data, is on TechnologyChecker.io.