shouldiuse.io

Categories

VERDICT

UNPKG Review

Depends

Should I use UNPKG?

The CDN for everything on npm - unpkg.com

· 1 month ago

Use it free for demos, prototypes, and quick script tags — it's dead simple and costs nothing. Don't build production sites on it: repeated outages and documented phishing abuse make jsDelivr or self-hosting safer.

Confidence

Medium. Based on 20+ public sources; some are low-quality SEO sites, so findings weighted toward Reddit, GitHub, and security press.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

$0

Free CDN

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • Quick demos and prototypes
  • Open-source docs and playgrounds
  • Browser-only apps with no build step
  • One-off script tags for libraries

Not for

  • Production sites — outages have broken thousands
  • Anything needing uptime SLAs or support
  • Security-sensitive orgs worried about supply-chain abuse
  • High-traffic apps needing guaranteed edge performance

Gotchas - check before you buy

high

Zero SLA or support — when it breaks, your site breaks with it

medium

Malicious npm packages serving phishing pages can ride on your unpkg references

medium

Common fix for reliability is migrating to jsDelivr — editing URLs everywhere

medium

Free service means no recourse or compensation during outages

Pros and cons

Pros

  • Completely free CDN covering every npm package
  • Simplest way to get an npm package into a browser
  • Used by 11.5% of all websites
  • Ideal for apps that run entirely in the browser

Cons

  • Multiple outages briefly broke thousands of websites
  • 520 errors made it completely unusable for real projects
  • 175 malicious npm packages abused it for phishing
  • Devs warn against relying on third parties for critical infrastructure
  • Slow package loading times reported by users

Sources & method

- 12 sources - No breach of unpkg itself found, but it is repeatedly abused as phishing infrastructure; one open-redirect report.

official x2review x7security x3
  • 175 malicious npm packages used unpkg for phishing, Coordinated campaign served phishing pages to 100+ companies via unpkg-hosted content.
  • 24 npm packages abused unpkg mirrors, Campaign used unpkg mirrors to host fake Cloudflare pages.
  • Open redirect vulnerability, Responsible-disclosure report OBB-3870005 filed against.

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 5/5. Completely free, open source
  • Ease of use: 5/5. Simplest way to get npm package into browser
  • Feature depth: 2/5. Just file serving; jsDelivr offers more
  • Support quality: 2/5. No SLA; outages left users stranded
  • Security posture: 2/5. Repeatedly abused for phishing campaigns
  • $0 Price Open source, fully free
  • 11.5% Web usage share of all websites, per w3techs
  • 2,864,548 Websites tracked BuiltWith tracking list

Pricing

Free CDN

$0

  • Every npm package
  • Global content delivery
  • No paid tier exists

Security

No breach of unpkg itself found, but it is repeatedly abused as phishing infrastructure; one open-redirect report.

  • 175 malicious npm packages used unpkg for phishingCoordinated campaign served phishing pages to 100+ companies via unpkg-hosted content.⁶
  • 24 npm packages abused unpkg mirrorsCampaign used unpkg mirrors to host fake Cloudflare pages.⁷
  • Open redirect vulnerabilityResponsible-disclosure report OBB-3870005 filed against.⁸

What users say

Users love the simplicity but repeatedly hit outages and warn against depending on it for anything important.

“Don't rely on other people hosting important infrastructure”
Reddit, r/webdev
“Anyone else getting 520 errors trying to fetch packages from unpkg.com?”
Reddit, r/sysadmin
“Yeah unpkg isn't the most reliable CDN out there.”
GitHub, stryker-mutator issue #215

Alternatives

Compare UNPKG with each alternative.

  • jsDelivr

    Free npm CDN with more features and better reliability record

    UNPKG vs jsDelivr

  • cdnjs

    Curated, security-vetted library CDN backed by Cloudflare

    UNPKG vs cdnjs

  • Self-hosted bundles

    Bundle dependencies yourself; removes third-party risk entirely

Companies that use it

  • Google
  • Microsoft
  • Facebook
Full analysis

Based on 20+ public sources; some are low-quality SEO sites, so findings weighted toward Reddit, GitHub, and security press.

Free npm CDN: perfect for demos, risky for production — repeated outages and phishing abuse documented.

Methodology

Based on 20+ public sources; some are low-quality SEO sites, so findings weighted toward Reddit, GitHub, and security press.

Read how a report is made.

Sources

  1. UNPKG official siteunpkg.com
    official
  2. unpkg/unpkg on GitHubgithub.com
    official
  3. A popular open-source CDN went down — Redditreddit.com
    review
  4. Unpkg down? 520 errors — Reddit r/sysadminreddit.com
    review
  5. UNPKG.com completely unusable — Nylas forumsforums.nylas.com
    review
  6. 175 malicious npm packages exploited unpkg — Socketsocket.dev
    security
  7. 24 npm packages abuse unpkg mirrors — Hacker Newsthehackernews.com
    security
  8. Open redirect report OBB-3870005openbugbounty.org
    security
  9. jsDelivr vs unpkg vs cdnjs benchmarkblog.blazingcdn.com
    review
  10. Migrate from unpkg to jsDelivrjsdelivr.com
    review
  11. unpkg usage statistics — w3techsw3techs.com
    review
  12. Consider replacing unpkg CDN — Stryker issuegithub.com
    review

Add this review to your site

This check for UNPKG says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends UNPKG Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.