Package install scripts · packages with a native build step
What share of widely-used packages that build or fetch a binary at install time have an install script that runs on every install?
77.06% of widely-used packages that build or fetch a binary at install time (95% CI 71.78–81.61%), measured across 279 packages on 2026-08-09.
Measured every Sunday since 2026-08-01 — 4 observations to date. Last measured 2026-08-09.
How this is measured
Bulk registry metadata. npm: hasInstallScript from the abbreviated packument. PyPI: a release shipping only an sdist, which pip builds via setup.py on the installing machine.
Built entirely from public bulk feeds — no target is contacted. Aggregate-only. 95% Wilson confidence intervals. Population: the most-downloaded packages per ecosystem plus a native-build stratum, from public registry metadata. Snapshot: packages-top400.
Licensed CC BY 4.0 — reuse with attribution to Quiet Failures. Download: JSON · CSV.
Why it matters
An install script is arbitrary code execution on every developer laptop and CI runner that installs the package — the mechanism behind most npm supply-chain compromises. On top- downloaded packages the rate is ~0.1%; among native-build packages it is ~77%. The contrast is the finding: risk concentrates precisely where compilation is required.
Limits of this measurement
The PyPI rule ("ships no wheel") is near-vacuous for top packages, which all ship wheels, so PyPI reads ~0% and needs that caveat or a better signal. Also: hasInstallScript appears only in npm's abbreviated packument — reading the full document returns false for everything.
The same check, other segments
- long-tail (packages)76.98%
- npm (packages)31.81%
- all packages20.02%
- top100m+ (packages)0.28%
- the most-downloaded packages0.12%
- pypi (packages)0%