unpkg
unpkg is a public mirror of npm, the registry where JavaScript libraries are published. Any file in any published package can be fetched from it by URL, which means a developer who wants a charting library or a date formatter can add one script tag and be done, instead of downloading the package and serving it from their own domain. That convenience is why it turns up on sites that otherwise carry very little. The index found it on 144 of the 5,294 pages measured, 2.7% of them, ranking 29th of the 88 companies broken out here.
This one sends code back, not just a request out
Most entries in this index describe something the page reports to: a beacon goes out, a counter goes up somewhere else. A package CDN is the reverse direction. The page asks for a JavaScript file and then runs whatever comes back, with the same access to the document as the site's own code.
The index counts that as one outside company, exactly like a pixel, because from the browser's point of view it is the same event: a connection to a domain the visitor did not choose. It is worth separating the two in your head anyway. A measurement tag that fails to load costs the site a statistic. A library that fails to load, or returns something other than what the site expected, changes what the page does. The vendor catalogue here files unpkg under CDN and does not classify it as tracking.
More than a quarter of these pages load a second package CDN
Across the 144 sites, jsDelivr — a different public mirror doing the same job — is present on 41 of them, 28.5%. Cloudflare is on the same 28.5%, Amazon CloudFront on 10.4%.
Two public package CDNs on one page is not usually a decision anyone made. It is what accumulates when a widget documented against one host is pasted in next to a component documented against another, over a few years and a few teams. Google is on 72.9% of the sites, OneTrust on 29.2%, Google Tag Manager on 13.2%, Cloudflare Analytics on 11.1%, Adobe Fonts on 10.4%, and Sentry and Optimizely on 7.6% each.
133 of 144 had contact before the banner could be answered
Early contact occurred on 133 of the 144 sites, 92.4%, which ranks 55th of the 88 companies here — the middle of that table. The median site reached 7 outside companies over 30 third-party requests, with 2 classified as tracking, and 6 companies inside the consent window. First contact came at a median of 628 ms, with the earliest anywhere in the group at 98 ms.
Every one of those placements sits between the 40th and 75th of 88. This is a component with no particular profile of its own: it is on light pages and heavy ones, because a developer needing a library is not a signal about what the marketing department has installed.
Who is loading libraries this way
The example sites are mostly companies that sell to developers. sentry.io reached 4 outside companies, all 4 inside the window. intercom.io reached 7 with 5 inside it behind a OneTrust banner, and wix.com 7 with 6 inside it. adobe.io reached 8 with 6 inside it, ea.com 8 with 7 inside it at 368 ms, zendesk.com 8 with 3 inside it at 1,308 ms. conviva.com reached 9 with all 9 inside the window, moloco.com 10 with 9.
The two heaviest examples are ad-adjacent rather than developer-facing: criteo.com at 12 companies with 8 inside the window, and washingtonpost.com at 12 with 10 inside it at 436 ms. wpguardian.com and wpguardian.io appear as separate entries with identical shapes — 7 companies each, all 7 inside the window, both behind a Usercentrics banner — differing only in timing, 579 ms against 1,521 ms.
Nearly half the group shows a banner
A consent tool was detected on 70 of the 144 sites — 48.6% of the group, close to an even split. OneTrust was seen on 42 of the 70, an IAB TCF consent tool on 12, CookieYes on 6, Cookiebot on 5, Osano on 3 and Usercentrics on 2. Those are sites where each tool was seen alongside the others, not a division of the 70, since one site can carry more than one banner.
After the window closes, the median site adds 1 further company. A small number, but not zero: on the typical page here the load is not quite finished when the question has been asked.
| Site | Companies | Before consent | First contact |
|---|---|---|---|
| sentry.io | 4 | 4 | 515 ms |
| criteo.com | 12 | 8 | 495 ms |
| adobe.io | 8 | 6 | 1024 ms |
| ea.com | 8 | 7 | 368 ms |
| zendesk.com | 8 | 3 | 1308 ms |
| washingtonpost.com | 12 | 10 | 436 ms |
| wix.com | 7 | 6 | 503 ms |
| intercom.io | 7 | 5 | 798 ms |
| wpguardian.com | 7 | 7 | 579 ms |
| wpguardian.io | 7 | 7 | 1521 ms |
| moloco.com | 10 | 9 | 760 ms |
| conviva.com | 9 | 9 | 607 ms |
| Tool | Sites |
|---|---|
| OneTrust | 42 |
| IAB TCF consent tool | 12 |
| CookieYes | 6 |
| Cookiebot | 5 |
| Osano | 3 |
| Usercentrics | 2 |
Seen on the same pages
Companies most often contacted by the same sites. Co-presence only — the crawl records what arrived, not who called whom.
- GoogleTogether on 105 of these sites
- OneTrustTogether on 42 of these sites
- CloudflareTogether on 41 of these sites
- jsDelivrTogether on 41 of these sites
- Google Tag ManagerTogether on 19 of these sites
- Cloudflare AnalyticsTogether on 16 of these sites
- Adobe FontsTogether on 15 of these sites
- Amazon CloudFrontTogether on 15 of these sites
Questions
Is unpkg a tracker?
The vendor catalogue behind this index files it under CDN and does not classify it as tracking. It still means the browser connects to an outside host during the load, and in this case runs the JavaScript that host returns.
Why would a site load code from a public CDN instead of hosting it?
It takes one line instead of a build step, and it is how most library documentation shows the quickest install. The trade is that the page now depends on a host the site does not run.
How many sites carry unpkg?
144 of the 5,294 measured, 2.7% of the corpus, ranking 29th of the 88 companies reported here.
Why do so many of these pages carry a second package CDN?
jsDelivr is present on 28.5% of the 144 sites. Widgets and components tend to arrive with whichever host their own documentation used, so a page assembled over several years often ends up pulling from more than one.
Can I see which outside hosts a page loads code from?
MurmStack, the browser extension this index was built from, lists them for whatever page you have open, along with how many were contacted before a consent choice was possible and when the first one landed.