$0
Price
Open source, fully free
Report
Should I Use UNPKG?
The CDN for everything on npm
Depends
DependsUse it free for demos, prototypes, and quick script tags — it's dead simple and costs nothing.
Free npm CDN: perfect for demos, risky for production — repeated outages and phishing abuse documented.
Confidence: Medium
11.5%
Web usage share
of all websites, per w3techs
2,864,548
Websites tracked
BuiltWith tracking list
Value for money
5
Completely free, open source
Ease of use
5
Simplest way to get npm package into browser
Feature depth
2
Just file serving; jsDelivr offers more
Support quality
2
No SLA; outages left users stranded
Security posture
2
Repeatedly abused for phishing campaigns
Pros
Cons
Gotchas
- highZero SLA or support — when it breaks, your site breaks with it⁵
- mediumMalicious npm packages serving phishing pages can ride on your unpkg references
- mediumCommon fix for reliability is migrating to jsDelivr — editing URLs everywhere10
- mediumFree service means no recourse or compensation during outages⁴
Best for
- Quick demos and prototypes
- Open-source docs and playgrounds
- Browser-only apps with no build step
- One-off script tags for libraries
Not for
- Production sites — outages have broken thousands
- Anything needing uptime SLAs or support
- Security-sensitive orgs worried about supply-chain abuse
- High-traffic apps needing guaranteed edge performance
Companies that use it
- Microsoft
Pricing
Free CDN
$0
- Every npm package
- Global content delivery
- No paid tier exists
Security
No breach of unpkg itself found, but it is repeatedly abused as phishing infrastructure; one open-redirect report.
- 175 malicious npm packages used unpkg for phishingCoordinated campaign served phishing pages to 100+ companies via unpkg-hosted content.⁶
- 24 npm packages abused unpkg mirrorsCampaign used unpkg mirrors to host fake Cloudflare pages.⁷
- Open redirect vulnerabilityResponsible-disclosure report OBB-3870005 filed against.⁸
What users say
Users love the simplicity but repeatedly hit outages and warn against depending on it for anything important.
“Don't rely on other people hosting important infrastructure”
“Anyone else getting 520 errors trying to fetch packages from unpkg.com?”
“Yeah unpkg isn't the most reliable CDN out there.”
Alternatives
Compare UNPKG with each alternative.
jsDelivr
Free npm CDN with more features and better reliability record
UNPKG vs jsDelivrcdnjs
Curated, security-vetted library CDN backed by Cloudflare
UNPKG vs cdnjsSelf-hosted bundles
Bundle dependencies yourself; removes third-party risk entirely
Skypack
npm-focused CDN alternative for browser delivery
UNPKG vs SkypackFull analysis
Based on 20+ public sources; some are low-quality SEO sites, so findings weighted toward Reddit, GitHub, and security press.
Sources
- UNPKG official siteunpkg.comofficial
- unpkg/unpkg on GitHubgithub.comofficial
review
- UNPKG.com completely unusable — Nylas forumsforums.nylas.comreview
security
- 24 npm packages abuse unpkg mirrors — Hacker Newsthehackernews.comsecurity
- Open redirect report OBB-3870005openbugbounty.orgsecurity
- jsDelivr vs unpkg vs cdnjs benchmarkblog.blazingcdn.comreview
- Migrate from unpkg to jsDelivrjsdelivr.comreview
- unpkg usage statistics — w3techsw3techs.comreview
review
Rate this review
Anonymous. You can change your vote.
Loading votes…
Ask a follow-up
Ask if a use case fits. Answers stay inside this report and its sources.
Comments
One queue. No replies. Give a display name first. Limit: 7 comments per day.
No comments yet.