Are npm downloads real?
They are real fetches, but not real users. npm itself says its counts are not the same as the number of users and that it does not filter out robots.
Why did my new package get 100 downloads?
Because you published it. Registry mirrors and security scanners fetch every new version right away. Tenable measured about 100–150 automated downloads for each version published. That says nothing about users.
Why does an old package still get downloads every week?
Crawlers fetch every published version a few times a week, used or not. A package with many versions can collect a steady count that way even if nobody installs it.
Can download counts be faked?
Yes. A script that requests the tarball URL directly counts the same as a real install: Tenable pushed a test package to 17,000 downloads in about an hour. A high count alone is not proof that a package is trusted, so check its dependents and repository too.
How many people use my npm package?
Nobody can say exactly, because npm does not record who downloaded what. You can get closer: remove the mirror spikes and the crawler traffic, then look at what is left and at who depends on the package. Search for your package here to see that, or read how the estimate works. What is left still includes CI and installs as a dependency of other packages.