Claudia Lynn

I was about to put my install count on my landing page. 2,411, which felt like a real number for something nine days old.
Then I split it by version and it fell apart. 0.1.0 got 172 downloads last week. So did 0.2.0, and 1.6.1, and every other version I have ever published, all sitting between 150 and 200. Nobody deliberately installs the first release of anything. A real user base concentrates almost entirely on latest. A flat line across every version that has ever existed is mirrors and scanners walking the registry, and they do that to every package, forever, whether or not one person wants your code.
So here is the check. It takes about two minutes. Split your downloads by version. Flat across all of them means automation. Concentrated on the newest one or two means people.Cross it against a surface only humans reach. My repo had 81 unique visitors while the registry was reporting 2,411 downloads. Thirty to one.Look for a spike with no correlated movement anywhere else. Mine had 1,542 downloads in a single day and the visitor graph for that day is flat. Nothing happened. A mirror woke up.
Then work out what you cannot see at all, which was the uncomfortable one for me. Anyone using my tool the way it is meant to be used never touches a single thing I can count. It runs locally. It never loads my site and never opens my repo. Their usage is indistinguishable from a scanner in the only number I have.
Search rank is the other one I would not lean on, and I say that as someone whose rank went up this week.
I am 5th on npm for "pre-production checklist" and 8th for "security checklist". Two days ago I was 8th and 8th. The only thing that changed in between was that I published a new version. Nobody needed anything for that to happen.
And then look at where my visitors actually came from. My own site, GitHub itself, the MCP registry, Google twice, Telegram once. npm is not on that list at all. Not low. Absent. Ranked 5th and it has sent me zero people, because almost nobody discovers a package by searching npm. They arrive already knowing the name.
There is a loop in it as well. npm's search score has a popularity component fed by download counts, and I have just spent this whole post establishing that my download count is mostly mirrors. So the rank is partly computed from the bot number, and then the rank gets quoted as evidence of traction. Same number, different hat.
The one query where my actual audience would be, "mcp checklist", I do not appear in at all. That is the only ranking of the four that would have told me anything useful, and it is the one nobody would ever screenshot.
What I track now is unique cloners, 116, and CDN file requests, 95 a week. Both far smaller than 2,411 and both far more likely to be a person.I still show a number on the site, because everyone does and a visitor reads mine against everyone else's. But I stopped using it to decide anything, and that turned out to be the part that mattered.
If you have shipped a package, go split yours by version. I would genuinely like to know whether anyone's is concentrated the way it is supposed to be, because I am starting to suspect almost nobody's is.