{
 "metric": "pkg-install-scripts",
 "segment": "download_tier-top100m",
 "anchor": "package",
 "label": "top100m+ (packages)",
 "population": "packages in top100m+",
 "states": [
  "present",
  "absent"
 ],
 "quiet_failure_states": [
  "present"
 ],
 "measurement": "Bulk registry metadata. npm: `hasInstallScript` from the **abbreviated packument**. PyPI: a release shipping only an sdist, which pip builds via `setup.py` on the installing machine.",
 "why_it_matters": "An install script is arbitrary code execution on every developer laptop and CI runner that installs the package — the mechanism behind most npm supply-chain compromises. On top- downloaded packages the rate is ~0.1%; among native-build packages it is ~77%. The contrast is the finding: risk concentrates precisely where compilation is required.",
 "limits": "The PyPI rule (\"ships no wheel\") is near-vacuous for top packages, which all ship wheels, so PyPI reads ~0% and needs that caveat or a better signal. Also: `hasInstallScript` appears **only** in npm's abbreviated packument — reading the full document returns false for everything.",
 "data_tier": "package",
 "population_predicate": "any",
 "entity_type": "package",
 "kind": "failure",
 "latest": {
  "day": "2026-08-09",
  "n": 727,
  "qf_pct": 0.28,
  "ci": [
   0.08,
   1
  ],
  "dist": {
   "absent": 99.72,
   "present": 0.28
  },
  "snapshot": "packages-top400"
 },
 "series": [
  {
   "day": "2026-08-01",
   "n": 722,
   "qf_pct": 0.14,
   "ci": [
    0.02,
    0.78
   ],
   "dist": {
    "present": 0.14,
    "absent": 99.86
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-02",
   "n": 723,
   "qf_pct": 0.28,
   "ci": [
    0.08,
    1
   ],
   "dist": {
    "absent": 99.72,
    "present": 0.28
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-04",
   "n": 722,
   "qf_pct": 0.28,
   "ci": [
    0.08,
    1
   ],
   "dist": {
    "present": 0.28,
    "absent": 99.72
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-05",
   "n": 722,
   "qf_pct": 0.28,
   "ci": [
    0.08,
    1
   ],
   "dist": {
    "absent": 99.72,
    "present": 0.28
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-09",
   "n": 727,
   "qf_pct": 0.28,
   "ci": [
    0.08,
    1
   ],
   "dist": {
    "absent": 99.72,
    "present": 0.28
   },
   "snapshot": "packages-top400"
  }
 ],
 "license": "CC BY 4.0",
 "source": "https://quietfailures.com/datasets/pkg-install-scripts/download_tier-top100m"
}