How many agent-related npm packages run code when you install them?
Installing a package can run code on your machine before you ever import it. This is ordinary and usually benign. It is also the point at which a change matters most.
n = 2,755 · measured 2026-10-19 · recomputed on every page loadResult
| Observation | Count | Share |
|---|---|---|
Declares postinstall |
246 | 8.9% |
Declares preinstall |
16 | 0.6% |
Declares install |
0 | 0% |
| Any of the three (runs code at install) | 262 | 9.5% |
Declares prepare (runs on local installs) |
317 | 11.5% |
| More than one account holds publish rights | 461 | 16.7% |
Why this is worth recording
A lifecycle script is a factual property of a published package, declared openly in its manifest. Most exist to compile a binary or set up a git hook. The reason we record it is that it is the field whose change carries the most consequence: a package that did not run code at install time and now does has altered what installing it does, on every machine that updates. That is observable, and until now nobody was watching it over time.
What this does and does not say
It does not say any of these packages are unsafe, and we make no claim about what any individual script does. Declaring a postinstall hook is a normal and widespread practice. This is a base rate, published so that a change against it is legible.
Method
- Drawn from the npm package document (not the search endpoint, which omits these fields entirely) for the most-downloaded agent-related packages, plus every package already observed to declare an install hook, so that the highest-consequence set never falls out of coverage.
- Counts are of declared lifecycle scripts. We do not execute, sandbox or analyse them.
prepareis counted separately because it runs on local and git installs rather than on a normal registry install, so it is a materially different exposure.
Full method and known limitations: methodology. Believe a specific record is wrong? Request a correction.