Package install scripts · all packages
What share of packages worldwide have an install script that runs on every install?
20.02% of packages worldwide (95% CI 17.74–22.51%), measured across 1,079 packages on 2026-08-09.
Measured every Sunday since 2026-08-01 — 5 observations to date. Last measured 2026-08-09.
How this is measured
Bulk registry metadata. npm: hasInstallScript from the abbreviated packument. PyPI: a release shipping only an sdist, which pip builds via setup.py on the installing machine.
Built entirely from public bulk feeds — no target is contacted. Aggregate-only. 95% Wilson confidence intervals. Population: the most-downloaded packages per ecosystem plus a native-build stratum, from public registry metadata. Snapshot: packages-top400.
Licensed CC BY 4.0 — reuse with attribution to Quiet Failures. Download: JSON · CSV.
Why it matters
An install script is arbitrary code execution on every developer laptop and CI runner that installs the package — the mechanism behind most npm supply-chain compromises. On top- downloaded packages the rate is ~0.1%; among native-build packages it is ~77%. The contrast is the finding: risk concentrates precisely where compilation is required.
Limits of this measurement
The PyPI rule ("ships no wheel") is near-vacuous for top packages, which all ship wheels, so PyPI reads ~0% and needs that caveat or a better signal. Also: hasInstallScript appears only in npm's abbreviated packument — reading the full document returns false for everything.