Does unpkg Work in China? Delivery, Reachability & Where ICP Really Applies
unpkg is a pure content CDN for public npm packages, served from Cloudflare's offshore global edge with no presence inside mainland China — so a site that loads its libraries at runtime can be dragged or broken there. unpkg itself raises no ICP or PIPL issue; that duty sits on your hosting site. A delivery-first look, honestly framed.
Does unpkg work in China?
unpkg isn't a compliance problem — it's a delivery one. It serves public open-source code, so it raises no PIPL or ICP question of its own; the catch is that it runs on an offshore CDN with no presence inside mainland China, so a page that pulls a library from unpkg at runtime can slow to a crawl or break for your Chinese visitors.
In its own words, "UNPKG is a fast, global content delivery network for everything on npm," and it "caches files on Cloudflare's global content-delivery network." That global network serves mainland China from points of presence outside the country — Cloudflare's in-country China Network is a separate, ICP-gated arrangement a public .com like unpkg.com does not use — so inside the mainland unpkg is frequently slow, throttled or unreachable. unpkg holds no personal data, so loading it is not itself a cross-border transfer of personal information; the ICP filing duty belongs to the site that embeds it, not to unpkg. The table below is unpkg's own wording and what each line actually decides.
This is a delivery risk map, not a verdict — whether a blocked library quietly degrades your site or takes it down depends on how your front-end loads it. Our China team can map your third-party-dependency exposure with you →
Compliance snapshot
- ✓ unpkg serves public npm code, not user data — no PIPL issue of its own
- ✕ No presence inside mainland China — it runs on Cloudflare's offshore global edge
- ! From inside the mainland it is frequently slow, throttled or unreachable
- ! A runtime unpkg <script> can stall or break the page that loads it
- ! The ICP duty sits on your hosting site — keep it filed and in-country
What UNPKG's own documentation says about China
| Fact | Primary source |
|---|---|
| unpkg is a content CDN for public code, in its own words. unpkg describes itself as "a fast, global content delivery network for everything on npm" — it serves open-source JavaScript packages, not your users' data. Because nothing personal passes through it, using unpkg is not itself a cross-border transfer of personal information under PIPL, and unpkg carries no ICP obligation of its own. | unpkg.com homepage, retrieved 2026-10-07 |
| It runs on Cloudflare's global edge, which has no in-country presence serving mainland China. unpkg states it "caches files on Cloudflare's global content-delivery network." Cloudflare's standard global edge reaches mainland China from points of presence outside the mainland — its in-country China Network is a separate, ICP-gated arrangement a public .com does not use (inference) — so unpkg has no mainland delivery footing. | unpkg.com homepage, retrieved 2026-10-07 |
| From inside mainland China unpkg is frequently slow, throttled or unreachable. Served from offshore Cloudflare points of presence across the border, requests to unpkg.com from the mainland are intermittently delayed or dropped, and the outcome shifts with network, route and time of day. A library loaded from unpkg at runtime is a dependency you do not control — and when it stalls, it blocks the rendering of the page that embeds it. | unpkg.com homepage (Cloudflare delivery statement), retrieved 2026-10-07; mainland reachability stated qualitatively |
| The compliance line falls on your hosting site, not on unpkg. A public site served to mainland visitors needs an ICP filing tied to an in-country hosting resource (State Council Order No. 292; MIIT Order No. 33) — an obligation on the site that embeds unpkg, not on the open-source CDN it pulls from. Keeping that site ICP-filed and in-country is the compliance half; serving its assets reliably is the delivery half. | State Council Order No. 292; MIIT Order No. 33 (summarized on 21YunBox's ICP guide) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience the question about unpkg is not whether it is allowed — it is whether it arrives. unpkg is a pure content CDN for public, open-source npm packages: it serves code, not your users’ data, so on its own it raises no personal-data-transfer or ICP question. What it does raise is a delivery one. unpkg runs on an offshore global edge with no presence inside mainland China, so a page that loads a library from unpkg at request time leans on infrastructure that is frequently slow or unreachable from the mainland — and when that dependency stalls, so does the page. The compliance line in this picture sits one step away, on the site that embeds unpkg, which still has to be ICP-filed and served in-country.
unpkg in China at a glance
| What decides it | In unpkg's own terms |
|---|---|
| Where it runs | Files are “cached on Cloudflare's global content-delivery network” (powered by Cloudflare Workers) — a worldwide edge with no point of presence inside mainland China. |
| What it serves | “Everything on npm” — public, open-source JavaScript packages. Code, not user data, so no personal information passes through unpkg. |
| Reachable from the mainland? | Served from Cloudflare points of presence outside the country, so from inside mainland China it is frequently slow, throttled or unreachable — a delivery risk, not a clean block. |
| Data residency / PIPL | Not triggered by unpkg itself: it holds no personal data. The cross-border-transfer question belongs to whatever your own site does with user data, elsewhere. |
| ICP filing | Not on unpkg — an open-source CDN carries none. The ICP duty sits on the site that embeds it, which must be filed and hosted in-country. |
A content CDN for public code — a delivery question, not a data one
unpkg describes itself as “a fast, global content delivery network for everything on npm,” serving files straight out of public npm packages. That framing matters for how you judge it in China: unpkg handles open-source code, not your users’ personal information, so loading it is not a cross-border transfer of personal data and it carries no ICP obligation of its own. Pretending otherwise — forcing a data-residency story onto a public code CDN — would be dishonest. The real exposure is narrower and more practical: can that code actually be fetched, quickly and every time, from inside the mainland?
Served from Cloudflare’s offshore edge, which does not sit inside mainland China
unpkg’s files are “cached on Cloudflare’s global content-delivery network,” served from Cloudflare’s worldwide edge (it is built on Cloudflare Workers). None of those locations is inside mainland China. Cloudflare’s standard global edge serves mainland traffic from points of presence across the border, and its in-country China Network is a separate, ICP-gated service a public .com like unpkg.com does not use — that last point is an inference from how Cloudflare provisions its China Network, not an unpkg statement. The result is the familiar one for any offshore CDN: from inside the mainland unpkg is frequently slow, throttled or simply unreachable, and the outcome shifts with the network, the route and the hour. A <script> that pulls a library from unpkg at load time hands that variability to your users — when the fetch stalls, the render waiting on it stalls too. It is a dependency you do not control, sitting on the wrong side of the border.
The compliance line falls on your hosting site, not on unpkg
Reaching the compliance door here means being precise about where that door actually is. unpkg does not need an ICP filing — but the public site that embeds it does. A website shown to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, tied to a hosting resource physically inside the mainland; and if that site also collects personal information from Chinese users, the cross-border transfer and data-residency rules of the Personal Information Protection Law apply to that site’s own data flows (PIPL Articles 38–43 and 40; Cybersecurity Law Article 39 (formerly Article 37)). unpkg sits inside none of that — yet a mainland site that quietly depends on it inherits unpkg’s delivery weakness while still owing every one of its own compliance duties.
This is a risk map, not a verdict: whether an unreliable third-party CDN merely slows your site or breaks it, and whether your own hosting and data position is sound, turns on how your front-end is built and what you collect — worth settling with counsel and a look at your actual dependencies.
Where 21YunBox fits — a compliant overlay, not a migration
You keep shipping the same front-end. We remove the offshore dependency unpkg introduces: the JavaScript assets your pages pull from it are served instead from ICP-filed delivery inside the mainland, set in front of your existing origin — no rebuild, no second codebase, and no change to the libraries your developers chose. Our China team also checks the part unpkg never touches: that the site embedding those assets is itself ICP-filed, hosted in-country, and clean on PIPL for whatever user data it does handle. The code stays identical; what changes is that it now arrives from the right side of the border.
Related reading:
Frequently Asked Questions
Is unpkg blocked in China?
Treat it as unreliable rather than cleanly blocked. unpkg runs on Cloudflare's global edge, which serves mainland China from points of presence outside the country, so requests from inside the mainland are frequently slow, throttled or dropped — and the outcome varies by network, route and time of day. For a site that fetches a library from unpkg at runtime, "sometimes unreachable" is the whole problem: when the request stalls, the page that depends on it stalls with it.
Does loading unpkg make my site non-compliant in China?
Not by itself. unpkg serves public open-source code, not personal data, so pulling a library from it is neither a PIPL cross-border transfer nor something that needs its own ICP filing. The compliance obligation lives with your hosting site — a public site shown to mainland visitors needs an ICP filing tied to an in-country host. unpkg's risk to you is delivery: an offshore dependency that can drag or break the page. Confirm your own filing position with counsel.
Can 21YunBox help serve these libraries reliably in China?
Yes. Our China team can take the JavaScript assets your site pulls from unpkg and serve them from reliable, ICP-filed delivery inside the mainland — in front of your existing origin, with no rebuild and no second codebase — so a blocked third-party CDN can't drag or break your page. We also check that the site embedding those assets is itself ICP-filed, hosted in-country, and sound on PIPL for whatever user data it handles. Get in touch to walk through your setup.
