The Libraries Behind curl's Flags: Content-Type Grew 414%, Proxy Support 300%

When you convert a curl command into code, the HTTP client is the easy half. axios.post(url, body) is one line. The other half is the flags: -H "Content-Type: …", -b cookie.jar, -x proxy:8080, --compressed, -L. Those are not features of a client library — each one is a separate problem with its own package, and most people never see them because the client library quietly depends on them.

This page counts those hidden packages. Source: the npm downloads API, window 2024-10-01 to 2026-10-10, pulled 2026-10-12, first 30 days against last 30. Swap the package name at the end of that URL to check any row.

The table

Installs, not requests made. Every figure is my own pull; publish dates come from the registry on the same date.

What the ordering says

Sort by growth and the top is set-cookie-parser (+11.9×), mime-types (+414%), content-disposition (+362%), cookie (+302%) and https-proxy-agent (+300%). Nothing at the top is "send a request." Everything at the top is understanding a header.

That is the real shape of HTTP work in 2026: the request is a solved problem, and the growth is in parsing what comes back and what goes out. Content negotiation, cookie state, attachment filenames, proxy routing — the parts a curl command encodes in eight characters of flags and a generated client has to reimplement correctly.

content-disposition at +362% is the row I did not expect. Its whole job is the Content-Disposition header — what filename a download gets. 677.2M installs a month means a large amount of software is handling file downloads, which fits everything else on this page: agents downloading artifacts, CI pulling build outputs, document pipelines. It grew four times faster than follow-redirects, and following redirects is the more fundamental capability. Adoption does not rank by importance.

Proxy support at +300% (https-proxy-agent, 1.182B installs) is the second signal worth naming. Corporate egress, scraping infrastructure, and LLM-tool sandboxes all route through an HTTP proxy, and the agent that implements -x is now installed at roughly the same scale as a content-type library. Two years ago I would have called proxying a niche requirement.

basic-auth-parser is the odd one out at +249% from a base of 0.32M — and last published 2021-10-21. It works, it is tiny, nobody maintains it, and it grew. A five-year-old unmaintained package growing 249% is not a quality signal; it is what happens when a dependency graph has no reason to move.

Two pairs that must not be summed

mime-types (1.246B) and mime-db (1.301B) are one lookup: the code and its data table. Same with proxy-agent and http-proxy-agent / https-proxy-agent, which are a dispatcher and its implementations. Adding them would invent a number — "3.5 billion installs of content-type handling" would be double-counted twice.

If you are hand-writing the code half

When a converter gives you axios.post(...) and you still have to make it behave like the curl command, these are the pieces:

• Wrong or missing Content-Type → mime-types to derive it from a filename rather than hardcoding application/octet-stream.
• -F uploads arriving empty → form-data for multipart streams; qs (+162%) when the body wants urlencoded nesting and arrays rather than a flat object.
• Cookies that do not survive a redirect → tough-cookie gives you an actual RFC 6265 jar; cookie handles the header strings, and they are different problems.
• -x not working in generated code → proxy-agent with https-proxy-agent; note the client library has to accept an agent, which rules out anything browser-only.
• Gzipped response saved as binary junk → --compressed means the server may compress; decompress-response handles it, and Accept-Encoding is what triggers it.
• Download saved as download instead of report.pdf → content-disposition, and only after following redirects (follow-redirects) because the final URL often determines the name.

I built a curl converter, so I have opinions. The last bullet is the one people hit least often and debug longest, because the failure is silent and the filename looks like a cosmetic detail.

What these numbers cannot tell you

• These are transitive dependencies. Almost nobody installs mime-db on purpose. The counts measure how often other tools need the capability, not developer preference.
• Related packages share one install. A request that needs a cookie jar pulls tough-cookie and cookie together, so their growth is correlated by construction.
• Growth rate and importance are unrelated. follow-redirects at +139% is more functionally central to using curl than content-disposition at +362%, and the numbers do not care.

Related

• HTTP client trends 2026 — the client libraries these packages hide inside
• The curl flags that actually matter — what each flag really does
• Cookies and downloads — -b and -J end to end, including the filename trap
• The curl cheatsheet — the flags and the packages behind them, one line each