{
 "metric": "pkg-install-scripts",
 "segment": "stratum-top-downloads",
 "anchor": "package",
 "label": "the most-downloaded packages",
 "population": "the most-downloaded packages",
 "states": [
  "present",
  "absent"
 ],
 "quiet_failure_states": [
  "present"
 ],
 "measurement": "Bulk registry metadata. npm: `hasInstallScript` from the **abbreviated packument**. PyPI: a release shipping only an sdist, which pip builds via `setup.py` on the installing machine.",
 "why_it_matters": "An install script is arbitrary code execution on every developer laptop and CI runner that installs the package — the mechanism behind most npm supply-chain compromises. On top- downloaded packages the rate is ~0.1%; among native-build packages it is ~77%. The contrast is the finding: risk concentrates precisely where compilation is required.",
 "limits": "The PyPI rule (\"ships no wheel\") is near-vacuous for top packages, which all ship wheels, so PyPI reads ~0% and needs that caveat or a better signal. Also: `hasInstallScript` appears **only** in npm's abbreviated packument — reading the full document returns false for everything.",
 "data_tier": "package",
 "population_predicate": "any",
 "entity_type": "package",
 "kind": "failure",
 "latest": {
  "day": "2026-08-09",
  "n": 800,
  "qf_pct": 0.12,
  "ci": [
   0.02,
   0.7
  ],
  "dist": {
   "absent": 99.88,
   "present": 0.12
  },
  "snapshot": "packages-top400"
 },
 "series": [
  {
   "day": "2026-08-02",
   "n": 800,
   "qf_pct": 0.12,
   "ci": [
    0.02,
    0.7
   ],
   "dist": {
    "absent": 99.88,
    "present": 0.12
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-04",
   "n": 800,
   "qf_pct": 0.12,
   "ci": [
    0.02,
    0.7
   ],
   "dist": {
    "absent": 99.88,
    "present": 0.12
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-05",
   "n": 800,
   "qf_pct": 0.12,
   "ci": [
    0.02,
    0.7
   ],
   "dist": {
    "absent": 99.88,
    "present": 0.12
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-09",
   "n": 800,
   "qf_pct": 0.12,
   "ci": [
    0.02,
    0.7
   ],
   "dist": {
    "absent": 99.88,
    "present": 0.12
   },
   "snapshot": "packages-top400"
  }
 ],
 "license": "CC BY 4.0",
 "source": "https://quietfailures.com/datasets/pkg-install-scripts/stratum-top-downloads"
}