In this case main culprit seems to be a package called handlebars-helpers which is a collection of utilities for working with the handlebars templating language which was pretty popular in the JS world for a while.

Sadly not and I think this is an important question because I’m sure the majority of those downloads are coming from some downstream packages that everyone is using.

Ordering and showing dependent-downloads would be useful in security issues when wanting to contact package authors who have the largest exposure to an exploited package.

It was raised on npm’s feedback before, I don’t think they were interested in adding it.

EDIT: the bulk of downloads appear to be from handlebars-helpers

Click ‘Dependents’.