{
 "metric": "pkg-install-scripts",
 "segment": "download_tier-long-tail",
 "anchor": "package",
 "label": "long-tail (packages)",
 "population": "packages in long-tail",
 "states": [
  "present",
  "absent"
 ],
 "quiet_failure_states": [
  "present"
 ],
 "measurement": "Bulk registry metadata. npm: `hasInstallScript` from the **abbreviated packument**. PyPI: a release shipping only an sdist, which pip builds via `setup.py` on the installing machine.",
 "why_it_matters": "An install script is arbitrary code execution on every developer laptop and CI runner that installs the package — the mechanism behind most npm supply-chain compromises. On top- downloaded packages the rate is ~0.1%; among native-build packages it is ~77%. The contrast is the finding: risk concentrates precisely where compilation is required.",
 "limits": "The PyPI rule (\"ships no wheel\") is near-vacuous for top packages, which all ship wheels, so PyPI reads ~0% and needs that caveat or a better signal. Also: `hasInstallScript` appears **only** in npm's abbreviated packument — reading the full document returns false for everything.",
 "data_tier": "package",
 "population_predicate": "any",
 "entity_type": "package",
 "kind": "failure",
 "latest": {
  "day": "2026-08-09",
  "n": 278,
  "qf_pct": 76.98,
  "ci": [
   71.68,
   81.54
  ],
  "dist": {
   "absent": 23.02,
   "present": 76.98
  },
  "snapshot": "packages-top400"
 },
 "series": [
  {
   "day": "2026-08-02",
   "n": 278,
   "qf_pct": 76.98,
   "ci": [
    71.68,
    81.54
   ],
   "dist": {
    "absent": 23.02,
    "present": 76.98
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-04",
   "n": 278,
   "qf_pct": 76.98,
   "ci": [
    71.68,
    81.54
   ],
   "dist": {
    "present": 76.98,
    "absent": 23.02
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-05",
   "n": 278,
   "qf_pct": 76.98,
   "ci": [
    71.68,
    81.54
   ],
   "dist": {
    "absent": 23.02,
    "present": 76.98
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-09",
   "n": 278,
   "qf_pct": 76.98,
   "ci": [
    71.68,
    81.54
   ],
   "dist": {
    "absent": 23.02,
    "present": 76.98
   },
   "snapshot": "packages-top400"
  }
 ],
 "license": "CC BY 4.0",
 "source": "https://quietfailures.com/datasets/pkg-install-scripts/download_tier-long-tail"
}