Installing a package can run code on your machine before you ever import it. This is ordinary and usually benign. It is also the point at which a change matters most.
n = 1,643 · measured 2026-09-03 · recomputed on every page load| Observation | Count | Share |
|---|---|---|
Declares postinstall |
184 | 11.2% |
Declares preinstall |
9 | 0.5% |
Declares install |
0 | 0% |
| Any of the three (runs code at install) | 193 | 11.7% |
Declares prepare (runs on local installs) |
219 | 13.3% |
| More than one account holds publish rights | 321 | 19.5% |
A lifecycle script is a factual property of a published package, declared openly in its manifest. Most exist to compile a binary or set up a git hook. The reason we record it is that it is the field whose change carries the most consequence: a package that did not run code at install time and now does has altered what installing it does, on every machine that updates. That is observable, and until now nobody was watching it over time.
It does not say any of these packages are unsafe, and we make no claim about what any individual script does. Declaring a postinstall hook is a normal and widespread practice. This is a base rate, published so that a change against it is legible.
prepare is counted separately because it runs on local and git installs rather
than on a normal registry install, so it is a materially different exposure.Full method and known limitations: methodology. Believe a specific record is wrong? Request a correction.