Nine HTTP Clients, Measured by Whether Anyone Is Still Home
Download counts tell you how many people pull a package. They cannot tell you whether anyone is still home. This page measures the second thing.
Every metadata cell is the registry's own value for the package's latest dist-tag, read on 2026-10-13 from registry.npmjs.org/<pkg>. Ages are stated against that fixed date and never as "X days ago", because a relative cell is true the day it is written and wrong every day after. Download cells are the published window 2024-10-01 to 2026-10-10 (first 30 days against last 30), pulled 2026-10-12 — same numbers as the libraries page.
The nine clients, as the registry has them
| Package | Latest | Released | Maintainers | Deps |
|---|---|---|---|---|
got | 16.1.0 | 2026-10-13 | 1 | 10 |
undici | 8.11.2 | 2026-09-24 | 3 | 0 |
superagent | 10.4.1 | 2026-09-23 | 7 | 9 |
ky | 2.2.0 | 2026-10-09 | 1 | 0 |
axios | 1.20.0 | 2026-08-26 | 1 | 4 |
node-fetch | 3.3.2 | 2023-07-25 | 5 | 3 |
formdata-node | 6.0.3 | 2023-10-24 | 1 | 0 |
cross-fetch | 4.1.0 | 2024-12-21 | 1 | 1 |
isomorphic-fetch | 3.0.0 | 2020-09-23 | 2 | 2 |
| Package | First 30 days | Last 30 days | Change |
|---|---|---|---|
got | 90.25M | 186.5M | +107% |
undici | 57.22M | 889.6M | +15.5× |
superagent | 41.83M | 104.2M | +149% |
ky | 8.161M | 30.53M | +274% |
axios | 234.6M | 527.4M | +125% |
node-fetch | 243.4M | 913.2M | +275% |
formdata-node | 13.52M | 74.04M | +448% |
cross-fetch | 69.94M | 172.7M | +147% |
isomorphic-fetch | 22.44M | 49.99M | +123% |
Five maintainers did not save node-fetch
This is the row that kills the naive version of "check the maintainer count".
node-fetch has 5 publish accounts — the second-highest in the table — and has not shipped since 2023-07-25, which is 1,176 days before the measurement date. It is also the second-largest number here at 913.2M downloads in the last 30 days, growing +275%. Five people can publish it and nobody has, for three years, while a quarter of a billion people a month pull it.
The reason is not neglect. Node grew a global fetch, so the polyfill's job ended; those five accounts are the residue of a project that succeeded and stopped needing anyone. That is the failure mode of maintainer count as a signal: it measures who can ship, not whether the package still has work to do. A high count next to an old date usually means a project finished, not one rotting.
isomorphic-fetch is the same shape further along: 2 maintainers, 2,211 days since 3.0.0, and still +123%. Cross-platform fetch shims had one purpose and that purpose is now in the runtime.
What healthy looks like in this table
undici is the winner's profile and every axis points the same way: 3 maintainers, 0 runtime dependencies, 19 days since 8.11.2, and +15.5× growth — the fastest in the set by a wide margin. Zero dependencies matters more than it looks for an HTTP client: it is the module in front of every request your service makes, and anything it pulls is now in that path too.
Contrast the two extremes of dependency weight:
got: 10 dependencies, 1 maintainer, released 2026-10-13. Genuinely maintained, and the transitive surface is the cost of that feature set.superagent: 9 dependencies, 7 maintainers, released 2026-09-23. The most publish accounts in the table and the second-heaviest tree.ky: 0 dependencies, 1 maintainer, 4 days, +274%. The opposite trade: minimal tree, single credential.
There is no clean correlation between maintainer count and anything else here. prettier-style team sizes are rare in this category; one maintainer is the default, and the honest question is per-package.
The decision this actually supports
If you are on node-fetch or isomorphic-fetch, the migration is overdue. Not because they are broken — they are stable and probably will stay stable. Because the runtime now does the job, so you are carrying a dependency for a capability you already have, and the day you find out is the day you discover your bundler needed it.
Do not read a fresh release date as a safety guarantee. got shipped the day this was pulled and has ten dependencies; the release tells you someone is home, not that those ten were reviewed.
Do not read an old release date as abandonment. formdata-node last shipped 2023-10-24 (1,085 days), has one maintainer, zero dependencies, and grew +448%. A builder for a multipart/form-data body has almost nothing left to fix.
What the dates do prove is narrow and worth more than a score: for node-fetch, formdata-node, cross-fetch, and isomorphic-fetch, a future fix is not something you can wait for. The record says nobody has shipped in 661 to 2,211 days. So the question is not "is this client good" but "can I live with being the person who forks it in 2028".
Related: curl flag libraries in 2026, HTTP client health, HTTP client alternatives, quoting hell, curl gotchas.
Metadata came from registry.npmjs.org on 2026-10-13 and is re-checked cell-by-cell by scripts/verify-registry-meta.mjs. Download cells are verified by scripts/verify-npm-figures.mjs against the window above. Ages were computed against the fixed date 2026-10-13, not against "today". Prose readings ("overdue", "finished", "healthy") are argument, not measurement, and the verifier deliberately leaves them alone.