{
 "metric": "pkg-install-scripts",
 "segment": "download_tier-top10m",
 "anchor": "package",
 "label": "top10m+ (packages)",
 "population": "packages in top10m+",
 "states": [
  "present",
  "absent"
 ],
 "quiet_failure_states": [
  "present"
 ],
 "measurement": "Bulk registry metadata. npm: `hasInstallScript` from the **abbreviated packument**. PyPI: a release shipping only an sdist, which pip builds via `setup.py` on the installing machine.",
 "why_it_matters": "An install script is arbitrary code execution on every developer laptop and CI runner that installs the package — the mechanism behind most npm supply-chain compromises. On top- downloaded packages the rate is ~0.1%; among native-build packages it is ~77%. The contrast is the finding: risk concentrates precisely where compilation is required.",
 "limits": "The PyPI rule (\"ships no wheel\") is near-vacuous for top packages, which all ship wheels, so PyPI reads ~0% and needs that caveat or a better signal. Also: `hasInstallScript` appears **only** in npm's abbreviated packument — reading the full document returns false for everything.",
 "data_tier": "package",
 "population_predicate": "any",
 "entity_type": "package",
 "kind": "failure",
 "latest": {
  "day": "2026-10-01",
  "n": 139,
  "qf_pct": 0.72,
  "ci": [
   0.13,
   3.96
  ],
  "dist": {
   "absent": 99.28,
   "present": 0.72
  },
  "snapshot": "packages-top400"
 },
 "series": [
  {
   "day": "2026-09-13",
   "n": 100,
   "qf_pct": 1,
   "ci": [
    0.18,
    5.45
   ],
   "dist": {
    "absent": 99,
    "present": 1
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-09-14",
   "n": 110,
   "qf_pct": 0.91,
   "ci": [
    0.16,
    4.97
   ],
   "dist": {
    "absent": 99.09,
    "present": 0.91
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-09-20",
   "n": 121,
   "qf_pct": 0.83,
   "ci": [
    0.15,
    4.53
   ],
   "dist": {
    "absent": 99.17,
    "present": 0.83
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-09-27",
   "n": 139,
   "qf_pct": 0.72,
   "ci": [
    0.13,
    3.96
   ],
   "dist": {
    "present": 0.72,
    "absent": 99.28
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-10-01",
   "n": 139,
   "qf_pct": 0.72,
   "ci": [
    0.13,
    3.96
   ],
   "dist": {
    "absent": 99.28,
    "present": 0.72
   },
   "snapshot": "packages-top400"
  }
 ],
 "license": "CC BY 4.0",
 "source": "https://quietfailures.com/datasets/pkg-install-scripts/download_tier-top10m"
}