{
 "metric": "pkg-install-scripts",
 "segment": "stratum-native-build",
 "anchor": "package",
 "label": "packages with a native build step",
 "population": "widely-used packages that build or fetch a binary at install time",
 "states": [
  "present",
  "absent"
 ],
 "quiet_failure_states": [
  "present"
 ],
 "measurement": "Bulk registry metadata. npm: `hasInstallScript` from the **abbreviated packument**. PyPI: a release shipping only an sdist, which pip builds via `setup.py` on the installing machine.",
 "why_it_matters": "An install script is arbitrary code execution on every developer laptop and CI runner that installs the package — the mechanism behind most npm supply-chain compromises. On top- downloaded packages the rate is ~0.1%; among native-build packages it is ~77%. The contrast is the finding: risk concentrates precisely where compilation is required.",
 "limits": "The PyPI rule (\"ships no wheel\") is near-vacuous for top packages, which all ship wheels, so PyPI reads ~0% and needs that caveat or a better signal. Also: `hasInstallScript` appears **only** in npm's abbreviated packument — reading the full document returns false for everything.",
 "data_tier": "package",
 "population_predicate": "any",
 "entity_type": "package",
 "kind": "failure",
 "latest": {
  "day": "2026-08-09",
  "n": 279,
  "qf_pct": 77.06,
  "ci": [
   71.78,
   81.61
  ],
  "dist": {
   "absent": 22.94,
   "present": 77.06
  },
  "snapshot": "packages-top400"
 },
 "series": [
  {
   "day": "2026-08-02",
   "n": 279,
   "qf_pct": 77.06,
   "ci": [
    71.78,
    81.61
   ],
   "dist": {
    "absent": 22.94,
    "present": 77.06
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-04",
   "n": 279,
   "qf_pct": 77.06,
   "ci": [
    71.78,
    81.61
   ],
   "dist": {
    "present": 77.06,
    "absent": 22.94
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-05",
   "n": 279,
   "qf_pct": 77.06,
   "ci": [
    71.78,
    81.61
   ],
   "dist": {
    "absent": 22.94,
    "present": 77.06
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-09",
   "n": 279,
   "qf_pct": 77.06,
   "ci": [
    71.78,
    81.61
   ],
   "dist": {
    "absent": 22.94,
    "present": 77.06
   },
   "snapshot": "packages-top400"
  }
 ],
 "license": "CC BY 4.0",
 "source": "https://quietfailures.com/datasets/pkg-install-scripts/stratum-native-build"
}