fix: use fast-npm-meta to get latest versions (#664)

app/components/Package/Versions.vue

···
 <script setup lang="ts">
-import type { PackageVersionInfo, PackumentVersion } from '#shared/types'
+import type { PackageVersionInfo, SlimVersion } from '#shared/types'
 import { compare } from 'semver'
 import type { RouteLocationRaw } from 'vue-router'
 import { fetchAllPackageVersions } from '~/composables/useNpmRegistry'
···
 
 const props = defineProps<{
   packageName: string
-  versions: Record<string, PackumentVersion>
+  versions: Record<string, SlimVersion>
   distTags: Record<string, string>
   time: Record<string, string>
 }>()
···
   deprecated?: string
 }
 
-// Check if a version has provenance/attestations
-function hasProvenance(version: PackumentVersion | undefined): boolean {
-  if (!version?.dist) return false
-  const dist = version.dist as { attestations?: unknown }
-  return !!dist.attestations
-}
-
 // Build route object for package version link
 function versionRoute(version: string): RouteLocationRaw {
   return {
···
 // Deduplicates so each version appears only once, with all its tags
 const allTagRows = computed(() => {
   // Group tags by version with their metadata
-  const versionMap = new Map<
-    string,
-    { tags: string[]; versionData: PackumentVersion | undefined }
-  >()
+  const versionMap = new Map<string, { tags: string[]; versionData: SlimVersion | undefined }>()
   for (const [tag, version] of Object.entries(props.distTags)) {
     const existing = versionMap.get(version)
     if (existing) {
···
         version,
         time: props.time[version],
         tags,
-        hasProvenance: hasProvenance(versionData),
+        hasProvenance: versionData?.hasProvenance,
         deprecated: versionData?.deprecated,
       } as VersionDisplay,
     }))

app/composables/useNpmRegistry.ts

···
 import type {
   Packument,
-  PackumentVersion,
   SlimPackument,
   NpmSearchResponse,
   NpmSearchResult,
···
   NpmPerson,
   PackageVersionInfo,
 } from '#shared/types'
+import { getVersions } from 'fast-npm-meta'
+import type { ResolvedPackageVersion } from 'fast-npm-meta'
 import type { ReleaseType } from 'semver'
 import { mapWithConcurrency } from '#shared/utils/async'
 import { maxSatisfying, prerelease, major, minor, diff, gt, compare } from 'semver'
-import { isExactVersion } from '~/utils/versions'
 import { extractInstallScriptsInfo } from '~/utils/install-scripts'
 import type { CachedFetchFunction } from '#shared/utils/fetch-cache-config'
 
···
   return downloads
 }
 
-/**
- * Encode a package name for use in npm registry URLs.
- * Handles scoped packages (e.g., @scope/name -> @scope%2Fname).
- */
-export function encodePackageName(name: string): string {
-  if (name.startsWith('@')) {
-    return `@${encodeURIComponent(name.slice(1))}`
-  }
-  return encodeURIComponent(name)
-}
-
 /** Number of recent versions to include in initial payload */
 const RECENT_VERSIONS_COUNT = 5
 
···
   }
 
   // Build filtered versions object with install scripts info per version
-  const filteredVersions: Record<string, PackumentVersion> = {}
+  const filteredVersions: Record<string, SlimVersion> = {}
+  let versionData: SlimPackumentVersion | null = null
   for (const v of includedVersions) {
     const version = pkg.versions[v]
     if (version) {
-      // Strip readme from each version, extract install scripts info
-      const { readme: _readme, scripts, ...slimVersion } = version
+      if (version.version === requestedVersion) {
+        // Strip readme from each version, extract install scripts info
+        const { readme: _readme, scripts, ...slimVersion } = version
 
-      // Extract install scripts info (which scripts exist + npx deps)
-      const installScripts = scripts ? extractInstallScriptsInfo(scripts) : null
-
+        // Extract install scripts info (which scripts exist + npx deps)
+        const installScripts = scripts ? extractInstallScriptsInfo(scripts) : null
+        versionData = {
+          ...slimVersion,
+          installScripts: installScripts ?? undefined,
+        }
+      }
       filteredVersions[v] = {
-        ...slimVersion,
-        installScripts: installScripts ?? undefined,
-      } as PackumentVersion
+        ...((version?.dist as { attestations?: unknown }) ? { hasProvenance: true } : {}),
+        version: version.version,
+        deprecated: version.deprecated,
+        tags: version.tags as string[],
+      }
     }
   }
 
···
     'keywords': pkg.keywords,
     'repository': pkg.repository,
     'bugs': pkg.bugs,
+    'requestedVersion': versionData,
     'versions': filteredVersions,
   }
 }
 
+export function useResolvedVersion(
+  packageName: MaybeRefOrGetter<string>,
+  requestedVersion: MaybeRefOrGetter<string | null>,
+) {
+  return useFetch(
+    () => {
+      const version = toValue(requestedVersion)
+      return version
+        ? `https://npm.antfu.dev/${toValue(packageName)}@${version}`
+        : `https://npm.antfu.dev/${toValue(packageName)}`
+    },
+    {
+      transform: (data: ResolvedPackageVersion) => data.version,
+    },
+  )
+}
+
 export function usePackage(
   name: MaybeRefOrGetter<string>,
   requestedVersion?: MaybeRefOrGetter<string | null>,
···
       })
       const reqVer = toValue(requestedVersion)
       const pkg = transformPackument(r, reqVer)
-      const resolvedVersion = getResolvedVersion(pkg, reqVer)
-      return { ...pkg, resolvedVersion, isStale }
+      return { ...pkg, isStale }
     },
   )
 
···
   }
 
   return asyncData
-}
-
-function getResolvedVersion(pkg: SlimPackument, reqVer?: string | null): string | null {
-  if (!pkg || !reqVer) return null
-
-  // 1. Check if it's already an exact version in pkg.versions
-  if (isExactVersion(reqVer) && pkg.versions[reqVer]) {
-    return reqVer
-  }
-
-  // 2. Check if it's a dist-tag (latest, next, beta, etc.)
-  const tagVersion = pkg['dist-tags']?.[reqVer]
-  if (tagVersion) {
-    return tagVersion
-  }
-
-  // 3. Try to resolve as a semver range
-  const versions = Object.keys(pkg.versions)
-  const resolved = maxSatisfying(versions, reqVer)
-  return resolved
 }
 
 export function usePackageDownloads(
···
 const allVersionsCache = new Map<string, Promise<PackageVersionInfo[]>>()
 
 /**
- * Fetch all versions of a package from the npm registry.
+ * Fetch all versions of a package using fast-npm-meta API.
  * Returns version info sorted by version (newest first).
  * Results are cached to avoid duplicate requests.
  *
  * Note: This is a standalone async function for use in event handlers.
  * For composable usage, use useAllPackageVersions instead.
+ *
+ * @see https://github.com/antfu/fast-npm-meta
  */
 export async function fetchAllPackageVersions(packageName: string): Promise<PackageVersionInfo[]> {
   const cached = allVersionsCache.get(packageName)
   if (cached) return cached
 
   const promise = (async () => {
-    const encodedName = encodePackageName(packageName)
-    // Use regular $fetch for client-side calls (this is called on user interaction)
-    const data = await $fetch<{
-      versions: Record<string, { deprecated?: string }>
-      time: Record<string, string>
-    }>(`${NPM_REGISTRY}/${encodedName}`)
+    const data = await getVersions(packageName, { metadata: true })
 
-    return Object.entries(data.versions)
-      .filter(([v]) => data.time[v])
-      .map(([version, versionData]) => ({
+    return Object.entries(data.versionsMeta)
+      .map(([version, meta]) => ({
         version,
-        time: data.time[version],
-        hasProvenance: false, // Would need to check dist.attestations for each version
-        deprecated: versionData.deprecated,
+        time: meta.time,
+        hasProvenance: meta.provenance === 'trustedPublisher' || meta.provenance === true,
+        deprecated: meta.deprecated,
       }))
       .sort((a, b) => compare(b.version, a.version))
   })()

app/composables/usePackageComparison.ts

···
 import type { FacetValue, ComparisonFacet, ComparisonPackage } from '#shared/types'
+import { encodePackageName } from '#shared/utils/npm'
 import type { PackageAnalysisResponse } from './usePackageAnalysis'
 
 export interface PackageComparisonData {
···
     isFacetLoading,
     isColumnLoading,
   }
-}
-
-function encodePackageName(name: string): string {
-  if (name.startsWith('@')) {
-    return `@${encodeURIComponent(name.slice(1))}`
-  }
-  return encodeURIComponent(name)
 }
 
 function computeFacetValue(facet: ComparisonFacet, data: PackageComparisonData): FacetValue | null {

app/pages/[...package].vue

···
 const { data: packageAnalysis } = usePackageAnalysis(packageName, requestedVersion)
 const { data: moduleReplacement } = useModuleReplacement(packageName)
 
-const { data: pkg, status, error } = await usePackage(packageName, requestedVersion)
-const resolvedVersion = computed(() => pkg.value?.resolvedVersion ?? null)
-
-// Get the version to display (resolved version or latest)
-const displayVersion = computed(() => {
-  if (!pkg.value) return null
+const { data: resolvedVersion } = await useResolvedVersion(packageName, requestedVersion)
 
-  // Use resolved version if available
-  if (resolvedVersion.value) {
-    return pkg.value.versions[resolvedVersion.value] ?? null
-  }
-
-  // Fallback to latest
-  const latestTag = pkg.value['dist-tags']?.latest
-  if (!latestTag) return null
-  return pkg.value.versions[latestTag] ?? null
-})
+const { data: pkg, status, error } = usePackage(packageName, requestedVersion)
+const displayVersion = computed(() => pkg.value?.requestedVersion ?? null)
 
 // Process package description
 const pkgDescription = useMarkdown(() => ({
···
 // This is the same composable used by PackageVulnerabilityTree and PackageDeprecatedTree
 const { data: vulnTree, status: vulnTreeStatus } = useDependencyAnalysis(
   packageName,
-  () => displayVersion.value?.version ?? '',
+  () => resolvedVersion.value ?? '',
 )
 
 // Keep latestVersion for comparison (to show "(latest)" badge)
···
 
 // Docs URL: use our generated API docs
 const docsLink = computed(() => {
-  if (!displayVersion.value) return null
+  if (!resolvedVersion.value) return null
 
   return {
     name: 'docs' as const,
     params: {
-      path: [...pkg.value!.name.split('/'), 'v', displayVersion.value.version],
+      path: [...pkg.value!.name.split('/'), 'v', resolvedVersion.value],
     },
   }
 })
···
 onKeyStroke(
   e => isKeyWithoutModifiers(e, '.') && !isEditableElement(e.target),
   e => {
-    if (pkg.value == null || displayVersion.value == null) return
+    if (pkg.value == null || resolvedVersion.value == null) return
     e.preventDefault()
     navigateTo({
       name: 'code',
       params: {
-        path: [pkg.value.name, 'v', displayVersion.value.version],
+        path: [pkg.value.name, 'v', resolvedVersion.value],
       },
     })
   },
···
 
 defineOgImageComponent('Package', {
   name: () => pkg.value?.name ?? 'Package',
-  version: () => displayVersion.value?.version ?? '',
+  version: () => resolvedVersion.value ?? '',
   downloads: () => (downloads.value ? $n(downloads.value.downloads) : ''),
   license: () => pkg.value?.license ?? '',
   stars: () => stars.value ?? 0,
···
 
           <span id="copy-pkg-name" class="sr-only">{{ $t('package.copy_name') }}</span>
           <span
-            v-if="displayVersion"
+            v-if="resolvedVersion"
             class="inline-flex items-baseline gap-1.5 font-mono text-base sm:text-lg text-fg-muted shrink-0"
           >
             <!-- Version resolution indicator (e.g., "latest → 4.2.0") -->
-            <template v-if="resolvedVersion !== requestedVersion">
+            <template v-if="requestedVersion && resolvedVersion !== requestedVersion">
               <span class="font-mono text-fg-muted text-sm">{{ requestedVersion }}</span>
               <span class="i-carbon:arrow-right rtl-flip w-3 h-3" aria-hidden="true" />
             </template>
 
             <NuxtLink
-              v-if="resolvedVersion !== requestedVersion"
-              :to="`/${pkg.name}/v/${displayVersion.version}`"
+              v-if="requestedVersion && resolvedVersion !== requestedVersion"
+              :to="`/${pkg.name}/v/${resolvedVersion}`"
               :title="$t('package.view_permalink')"
-              >{{ displayVersion.version }}</NuxtLink
+              >{{ resolvedVersion }}</NuxtLink
             >
-            <span v-else>v{{ displayVersion.version }}</span>
+            <span v-else>v{{ resolvedVersion }}</span>
 
             <a
               v-if="hasProvenance(displayVersion)"
-              :href="`https://www.npmjs.com/package/${pkg.name}/v/${displayVersion.version}#provenance`"
+              :href="`https://www.npmjs.com/package/${pkg.name}/v/${resolvedVersion}#provenance`"
               target="_blank"
               rel="noopener noreferrer"
               class="inline-flex items-center justify-center gap-1.5 text-fg-muted hover:text-fg transition-colors duration-200 min-w-6 min-h-6"
···
               <span class="i-solar:shield-check-outline w-3.5 h-3.5 shrink-0" aria-hidden="true" />
             </a>
             <span
-              v-if="
-                requestedVersion &&
-                latestVersion &&
-                displayVersion.version !== latestVersion.version
-              "
+              v-if="requestedVersion && latestVersion && resolvedVersion !== latestVersion.version"
               class="text-fg-subtle text-sm shrink-0"
               >{{ $t('package.not_latest') }}</span
             >
···
           <!-- Package metrics (module format, types) -->
           <ClientOnly>
             <PackageMetricsBadges
-              v-if="displayVersion"
+              v-if="resolvedVersion"
               :package-name="pkg.name"
-              :version="displayVersion.version"
+              :version="resolvedVersion"
               :is-binary="isBinaryOnly"
               class="self-baseline ms-1 sm:ms-2"
             />
···
 
           <!-- Internal navigation: Docs + Code + Compare (hidden on mobile, shown in external links instead) -->
           <nav
-            v-if="displayVersion"
+            v-if="resolvedVersion"
             :aria-label="$t('package.navigation')"
             class="hidden sm:flex items-center gap-0.5 p-0.5 bg-bg-subtle border border-border-subtle rounded-md shrink-0 ms-auto self-center"
           >
···
               :to="{
                 name: 'code',
                 params: {
-                  path: [...pkg.name.split('/'), 'v', displayVersion.version],
+                  path: [...pkg.name.split('/'), 'v', resolvedVersion],
                 },
               }"
               class="px-2 py-1.5 font-mono text-xs rounded transition-colors duration-150 border border-transparent text-fg-subtle hover:text-fg hover:bg-bg hover:shadow hover:border-border focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-fg/50 inline-flex items-center gap-1.5"
···
                 {{ $t('package.links.docs') }}
               </NuxtLink>
             </li>
-            <li v-if="displayVersion" class="sm:hidden">
+            <li v-if="resolvedVersion" class="sm:hidden">
               <NuxtLink
                 :to="{
                   name: 'code',
                   params: {
-                    path: [...pkg.name.split('/'), 'v', displayVersion.version],
+                    path: [...pkg.name.split('/'), 'v', resolvedVersion],
                   },
                 }"
                 class="link-subtle font-mono text-sm inline-flex items-center gap-1.5"
···
 
               <a
                 v-if="getDependencyCount(displayVersion) > 0"
-                :href="`https://node-modules.dev/grid/depth#install=${pkg.name}${displayVersion?.version ? `@${displayVersion.version}` : ''}`"
+                :href="`https://node-modules.dev/grid/depth#install=${pkg.name}${resolvedVersion ? `@${resolvedVersion}` : ''}`"
                 target="_blank"
                 rel="noopener noreferrer"
                 class="text-fg-subtle hover:text-fg transition-colors duration-200 inline-flex items-center justify-center min-w-6 min-h-6 -m-1 p-1"
···
         <!-- Vulnerability scan -->
         <ClientOnly>
           <PackageVulnerabilityTree
-            v-if="displayVersion"
+            v-if="resolvedVersion"
             :package-name="pkg.name"
-            :version="displayVersion.version"
+            :version="resolvedVersion"
           />
           <PackageDeprecatedTree
-            v-if="displayVersion"
+            v-if="resolvedVersion"
             :package-name="pkg.name"
-            :version="displayVersion.version"
+            :version="resolvedVersion"
             class="mt-3"
           />
         </ClientOnly>
···
 
           <!-- Dependencies -->
           <PackageDependencies
-            v-if="hasDependencies && displayVersion"
+            v-if="hasDependencies && resolvedVersion && displayVersion"
             :package-name="pkg.name"
-            :version="displayVersion.version"
+            :version="resolvedVersion"
             :dependencies="displayVersion.dependencies"
             :peer-dependencies="displayVersion.peerDependencies"
             :peer-dependencies-meta="displayVersion.peerDependenciesMeta"

app/pages/docs/[...path].vue

···
 <script setup lang="ts">
 import { setResponseHeader } from 'h3'
 import type { DocsResponse } from '#shared/types'
-import { assertValidPackageName } from '#shared/utils/npm'
+import { assertValidPackageName, fetchLatestVersion } from '#shared/utils/npm'
 
 definePageMeta({
   name: 'docs',
···
 
 const latestVersion = computed(() => pkg.value?.['dist-tags']?.latest ?? null)
 
-if (import.meta.server && !requestedVersion.value) {
+if (import.meta.server && !requestedVersion.value && packageName.value) {
   const app = useNuxtApp()
-  const { data: pkg } = await usePackage(packageName)
-  const latest = pkg.value?.['dist-tags']?.latest
-  if (latest) {
+  const version = await fetchLatestVersion(packageName.value)
+  if (version) {
     setResponseHeader(useRequestEvent()!, 'Cache-Control', 'no-cache')
     app.runWithContext(() =>
-      navigateTo('/docs/' + packageName.value + '/v/' + latest, { redirectCode: 302 }),
+      navigateTo('/docs/' + packageName.value + '/v/' + version, { redirectCode: 302 }),
     )
   }
 }

package.json

···
     "@vitest/coverage-v8": "4.0.18",
     "@vue/test-utils": "2.4.6",
     "axe-core": "4.11.1",
+    "fast-npm-meta": "1.0.0",
     "knip": "5.82.1",
     "lint-staged": "16.2.7",
     "playwright-core": "1.58.0",

pnpm-lock.yaml

···
       axe-core:
         specifier: 4.11.1
         version: 4.11.1
+      fast-npm-meta:
+        specifier: 1.0.0
+        version: 1.0.0
       knip:
         specifier: 5.82.1
         version: 5.82.1(@types/node@24.10.9)(typescript@5.9.3)
···
 
   fast-npm-meta@0.4.8:
     resolution: {integrity: sha512-ybZVlDZ2PkO79dosM+6CLZfKWRH8MF0PiWlw8M4mVWJl8IEJrPfxYc7Tsu830Dwj/R96LKXfePGTSzKWbPJ08w==}
+
+  fast-npm-meta@1.0.0:
+    resolution: {integrity: sha512-LZN+gRB2TnkkhRbNnTOgEXyhNBkDypngGX9nJzcKzrOaIQqfZnWEDYdxBqGw6bgiyl0tzpxDuTk1G7tKHyUcsg==}
 
   fast-redact@3.5.0:
     resolution: {integrity: sha512-dwsoQlS7h9hMeYUq1W++23NDcBLV4KqONnITDV9DjfS3q1SgDGVrBdvvTLUotWtPSD7asWDV9/CmsZPy8Hf70A==}
···
   fast-levenshtein@2.0.6: {}
 
   fast-npm-meta@0.4.8: {}
+
+  fast-npm-meta@1.0.0: {}
 
   fast-redact@3.5.0: {}
 

server/api/registry/analysis/[...pkg].get.ts

···
   ERROR_PACKAGE_ANALYSIS_FAILED,
 } from '#shared/utils/constants'
 import { parseRepoUrl } from '#shared/utils/git-providers'
-
-/** Minimal packument data needed to check deprecation status */
-interface MinimalPackument {
-  'name': string
-  'dist-tags'?: { latest?: string }
-  'versions'?: Record<string, { deprecated?: string }>
-}
+import { getLatestVersion, getLatestVersionBatch } from 'fast-npm-meta'
 
 export default defineCachedEventHandler(
   async event => {
···
 }
 
 /**
- * Fetch @types package info including deprecation status.
+ * Fetch @types package info including deprecation status using fast-npm-meta.
  * Returns undefined if the package doesn't exist.
  */
 async function fetchTypesPackageInfo(packageName: string): Promise<TypesPackageInfo | undefined> {
-  try {
-    const encodedName = encodePackageName(packageName)
-    // Fetch abbreviated packument to check latest version's deprecation status
-    const packument = await $fetch<MinimalPackument>(`${NPM_REGISTRY}/${encodedName}`, {
-      headers: {
-        // Request abbreviated packument to reduce payload
-        Accept: 'application/vnd.npm.install-v1+json',
-      },
-    })
-
-    // Get the latest version's deprecation message if any
-    const latestVersion = packument['dist-tags']?.latest
-    const deprecated = latestVersion ? packument.versions?.[latestVersion]?.deprecated : undefined
-
-    return {
-      packageName,
-      deprecated,
-    }
-  } catch {
+  const result = await getLatestVersion(packageName, { metadata: true, throw: false })
+  if ('error' in result) {
     return undefined
+  }
+  return {
+    packageName,
+    deprecated: result.deprecated,
   }
 }
 
···
 }
 
 /**
- * Find an associated create-* package by trying multiple naming patterns in parallel.
+ * Find an associated create-* package by trying multiple naming patterns using batch API.
  * Returns the first associated package found (preferring create-{name} over create-{name}-app).
  */
 async function findAssociatedCreatePackage(
···
   basePkg: ExtendedPackageJson,
 ): Promise<CreatePackageInfo | undefined> {
   const candidates = getCreatePackageNameCandidates(packageName)
-  const results = await Promise.all(candidates.map(name => fetchCreatePackageInfo(name, basePkg)))
-  return results.find(r => r !== undefined)
+
+  // Use batch API to fetch all candidates in a single request
+  const results = await getLatestVersionBatch(candidates, { metadata: true, throw: false })
+
+  // Process results in order (first valid match wins)
+  for (let i = 0; i < candidates.length; i++) {
+    const result = results[i]
+    const candidateName = candidates[i]
+    if (!result || !candidateName || 'error' in result) continue
+
+    // Need to fetch full package data for association validation (maintainers/repo)
+    const createPkgInfo = await fetchCreatePackageForValidation(
+      candidateName,
+      basePkg,
+      result.deprecated,
+    )
+    if (createPkgInfo) {
+      return createPkgInfo
+    }
+  }
+
+  return undefined
 }
 
 /**
- * Fetch create-* package info including deprecation status.
- * Validates that the create-* package is actually associated with the base package.
- * Returns undefined if the package doesn't exist or isn't associated.
+ * Fetch create-* package metadata for association validation.
+ * Returns CreatePackageInfo if the package is associated with the base package.
  */
-async function fetchCreatePackageInfo(
+async function fetchCreatePackageForValidation(
   createPkgName: string,
   basePkg: ExtendedPackageJson,
+  deprecated: string | undefined,
 ): Promise<CreatePackageInfo | undefined> {
   try {
     const encodedName = encodePackageName(createPkgName)
···
 
     return {
       packageName: createPkgName,
-      deprecated: createPkg.deprecated,
+      deprecated,
     }
   } catch {
     return undefined

server/api/registry/badge/[...pkg].get.ts

···
 import { createError, getRouterParam, setHeader } from 'h3'
 import { PackageRouteParamsSchema } from '#shared/schemas/package'
 import { CACHE_MAX_AGE_ONE_HOUR } from '#shared/utils/constants'
-import { fetchNpmPackage } from '#server/utils/npm'
+import { fetchLatestVersionWithFallback } from '#server/utils/npm'
 import { assertValidPackageName } from '#shared/utils/npm'
 import { handleApiError } from '#server/utils/error-handler'
 
···
       const label = `./ ${packageName}`
 
       const value =
-        requestedVersion ?? (await fetchNpmPackage(packageName))['dist-tags']?.latest ?? 'unknown'
+        requestedVersion ?? (await fetchLatestVersionWithFallback(packageName)) ?? 'unknown'
 
       const leftWidth = measureTextWidth(label)
       const rightWidth = measureTextWidth(value)

server/api/registry/install-size/[...pkg].get.ts

···
         version: rawVersion,
       })
 
-      // If no version specified, resolve to latest
-      let version = requestedVersion
+      // If no version specified, resolve to latest using fast-npm-meta (lightweight)
+      let version: string | undefined = requestedVersion
       if (!version) {
-        const packument = await fetchNpmPackage(packageName)
-        version = packument['dist-tags']?.latest
-        if (!version) {
+        const latestVersion = await fetchLatestVersionWithFallback(packageName)
+        if (!latestVersion) {
           throw createError({
             statusCode: 404,
             message: 'No latest version found',
           })
         }
+        version = latestVersion
       }
 
       return await calculateInstallSize(packageName, version)

server/api/registry/vulnerabilities/[...pkg].get.ts

···
         version: rawVersion,
       })
 
-      // If no version specified, resolve to latest
-      let version = requestedVersion
+      // If no version specified, resolve to latest using fast-npm-meta (lightweight)
+      let version: string | undefined = requestedVersion
       if (!version) {
-        const packument = await fetchNpmPackage(packageName)
-        version = packument['dist-tags']?.latest
-        if (!version) {
+        const latestVersion = await fetchLatestVersionWithFallback(packageName)
+        if (!latestVersion) {
           throw createError({
             statusCode: 404,
             message: 'No latest version found',
           })
         }
+        version = latestVersion
       }
 
       return await analyzeDependencyTree(packageName, version)

server/utils/npm.ts

···
 import type { Packument } from '#shared/types'
+import { encodePackageName, fetchLatestVersion } from '#shared/utils/npm'
 import { maxSatisfying, prerelease } from 'semver'
+import { CACHE_MAX_AGE_FIVE_MINUTES } from '#shared/utils/constants'
 
 const NPM_REGISTRY = 'https://registry.npmjs.org'
 
-function encodePackageName(name: string): string {
-  if (name.startsWith('@')) {
-    return `@${encodeURIComponent(name.slice(1))}`
-  }
-  return encodeURIComponent(name)
-}
-
 export const fetchNpmPackage = defineCachedFunction(
   async (name: string): Promise<Packument> => {
     const encodedName = encodePackageName(name)
     return await $fetch<Packument>(`${NPM_REGISTRY}/${encodedName}`)
   },
   {
-    maxAge: 60 * 5,
+    maxAge: CACHE_MAX_AGE_FIVE_MINUTES,
     swr: true,
     name: 'npm-package',
     getKey: (name: string) => name,
   },
 )
+
+/**
+ * Get the latest version of a package using fast-npm-meta API.
+ * Falls back to full packument if fast-npm-meta fails.
+ *
+ * @param name Package name
+ * @returns Latest version string or null if not found
+ */
+export async function fetchLatestVersionWithFallback(name: string): Promise<string | null> {
+  const version = await fetchLatestVersion(name)
+  if (version) return version
+
+  // Fallback to full packument (also cached)
+  try {
+    const packument = await fetchNpmPackage(name)
+    return packument['dist-tags']?.latest ?? null
+  } catch {
+    return null
+  }
+}
 
 /**
  * Check if a version constraint explicitly includes a prerelease tag.

shared/types/npm-registry.ts

···
   installScripts?: InstallScriptsInfo
 }
 
+export type SlimVersion = Pick<SlimPackumentVersion, 'version' | 'deprecated' | 'tags'> & {
+  hasProvenance?: true
+}
+
 /**
  * Slimmed down Packument for client-side use.
  * Strips unnecessary fields to reduce payload size.
···
   'keywords'?: string[]
   'repository'?: { type?: string; url?: string; directory?: string }
   'bugs'?: { url?: string; email?: string }
+  /** current version */
+  'requestedVersion': SlimPackumentVersion | null
   /** Only includes dist-tag versions (with installScripts info added per version) */
-  'versions': Record<string, SlimPackumentVersion>
+  'versions': Record<string, SlimVersion>
 }
 
 /**

shared/utils/constants.ts

···
 // Duration
 export const CACHE_MAX_AGE_ONE_MINUTE = 60
+export const CACHE_MAX_AGE_FIVE_MINUTES = 60 * 5
 export const CACHE_MAX_AGE_ONE_HOUR = 60 * 60
 export const CACHE_MAX_AGE_ONE_DAY = 60 * 60 * 24
 export const CACHE_MAX_AGE_ONE_YEAR = 60 * 60 * 24 * 365

shared/utils/npm.ts

···
+import { getLatestVersion } from 'fast-npm-meta'
 import { createError } from 'h3'
 import validatePackageName from 'validate-npm-package-name'
+
+/**
+ * Encode package name for URL usage.
+ * Scoped packages need special handling (@scope/name → @scope%2Fname)
+ */
+export function encodePackageName(name: string): string {
+  if (name.startsWith('@')) {
+    return `@${encodeURIComponent(name.slice(1))}`
+  }
+  return encodeURIComponent(name)
+}
+
+/**
+ * Fetch the latest version of a package using fast-npm-meta API.
+ * This is a lightweight alternative to fetching the full packument.
+ *
+ * @param name Package name
+ * @returns Latest version string or null if not found
+ * @see https://github.com/antfu/fast-npm-meta
+ */
+export async function fetchLatestVersion(name: string): Promise<string | null> {
+  try {
+    const meta = await getLatestVersion(name)
+    return meta.version
+  } catch {
+    return null
+  }
+}
 
 /**
  * Validate an npm package name and throw an HTTP error if invalid.

test/e2e/vulnerabilities.spec.ts

···
     )
     const response = await page.request.get(url)
 
-    expect(response.status()).toBe(502) // Based on handleApiError fallback
+    expect(response.status()).toBe(404) // Package not found returns 404
   })
 })

test/nuxt/a11y.spec.ts

···
 
   describe('PackageVersions', () => {
     it('should have no accessibility violations', async () => {
-      // Minimal mock data satisfying PackumentVersion type
+      // Minimal mock data satisfying SlimVersion type
       const mockVersion = {
-        _id: 'vue@3.5.0',
-        _npmVersion: '10.0.0',
-        name: 'vue',
         version: '3.5.0',
-        dist: { tarball: '', shasum: '', signatures: [] },
+        deprecated: undefined,
+        tags: undefined,
       }
       const component = await mountSuspended(PackageVersions, {
         props: {
           packageName: 'vue',
           versions: {
             '3.5.0': mockVersion,
-            '3.4.0': { ...mockVersion, _id: 'vue@3.4.0', version: '3.4.0' },
+            '3.4.0': { ...mockVersion, version: '3.4.0' },
           },
           distTags: {
             latest: '3.5.0',

test/nuxt/components/PackageVersions.spec.ts

···
 import { describe, expect, it, vi, beforeEach } from 'vitest'
 import { mountSuspended } from '@nuxt/test-utils/runtime'
 import PackageVersions from '~/components/Package/Versions.vue'
-import type { PackumentVersion } from '#shared/types'
+import type { SlimVersion } from '#shared/types'
 
 // Mock the fetchAllPackageVersions function
 const mockFetchAllPackageVersions = vi.fn()
···
 }))
 
 /**
- * Helper to create a minimal PackumentVersion for testing
+ * Helper to create a minimal SlimVersion for testing
  */
 function createVersion(
   version: string,
···
     deprecated?: string
     hasProvenance?: boolean
   } = {},
-): PackumentVersion {
-  const dist: Record<string, unknown> = {
-    tarball: `https://registry.npmjs.org/test-package/-/test-package-${version}.tgz`,
-    shasum: 'abc123',
-  }
-  if (options.hasProvenance) {
-    dist.attestations = { url: 'https://example.com', provenance: { predicateType: 'test' } }
-  }
+): SlimVersion {
   return {
-    _id: `test-package@${version}`,
-    _npmVersion: '10.0.0',
-    name: 'test-package',
     version,
-    dist,
     deprecated: options.deprecated,
-  } as unknown as PackumentVersion
+    tags: undefined,
+    ...(options.hasProvenance ? { hasProvenance: true } : {}),
+  } as SlimVersion
 }
 
 describe('PackageVersions', () => {
···
 
     it('shows count of hidden tagged versions', async () => {
       // Create more than MAX_VISIBLE_TAGS (10) dist-tags
-      const versions: Record<string, PackumentVersion> = {}
+      const versions: Record<string, SlimVersion> = {}
       const distTags: Record<string, string> = {}
       const time: Record<string, string> = {}
 
···
   describe('MAX_VISIBLE_TAGS limit', () => {
     it('limits visible tag rows to 10', async () => {
       // Create 15 dist-tags
-      const versions: Record<string, PackumentVersion> = {}
+      const versions: Record<string, SlimVersion> = {}
       const distTags: Record<string, string> = {}
       const time: Record<string, string> = {}