supply-chain · severity medium
Package install scripts
Share of widely-used packages that execute publisher-supplied code during installation — an npm lifecycle script, or a PyPI release shipping only a source archive that pip builds on the machine installing it.
Measured every Sunday · last updated
How it is measured
Bulk registry metadata. npm: hasInstallScript from the abbreviated packument. PyPI: a release shipping only an sdist, which pip builds via setup.py on the installing machine.
Why it matters
An install script is arbitrary code execution on every developer laptop and CI runner that installs the package — the mechanism behind most npm supply-chain compromises. On top- downloaded packages the rate is ~0.1%; among native-build packages it is ~77%. The contrast is the finding: risk concentrates precisely where compilation is required.
Limits of this measurement
The PyPI rule ("ships no wheel") is near-vacuous for top packages, which all ship wheels, so PyPI reads ~0% and needs that caveat or a better signal. Also: hasInstallScript appears only in npm's abbreviated packument — reading the full document returns false for everything.
The base rate
Measured over the full population of packages, from public bulk sources.
Every segment
Pick one to see the citable answer, with its trend and methodology.
From the newsletter
Where this base rate turned up as a real, fixable exposure.
Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.