{
 "title": "Install steps of the 5,000 most-downloaded npm packages, traced",
 "date": "2026-10-08",
 "method": "Package list: npm-high-impact 1.13.0, top-download order, first 5,000. Latest version of each read from the npm registry on 2026-10-08; 4,995 manifests read, 5 failed. Those declaring preinstall, install or postinstall, or a binding.gyp, were run through the Kenwea notary harness on its production sandbox (checker 2026-10-08.3): no network, no capabilities, read-only filesystem, uid 65534, inside node_modules of a project that depends on the package, npm lifecycle variables set, 15 s per step, each step under strace for connect, sendto, sendmsg and execve. Dependencies are not installed.",
 "packagesScanned": 4995,
 "packagesWithInstallCode": 31,
 "results": [
  {
   "rank": 44,
   "package": "esbuild",
   "version": "0.28.2",
   "declared": {
    "postinstall": "node install.js"
   },
   "verdict": "manual_review",
   "reasonCode": "step_timed_out",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node",
     "npm"
    ],
    "truncated": false
   },
   "seconds": 18.7
  },
  {
   "rank": 466,
   "package": "pnpm",
   "version": "12.10.1",
   "declared": {
    "preinstall": "node install.js",
    "postinstall": "node install.js"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "preinstall",
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 3.5
  },
  {
   "rank": 572,
   "package": "core-js",
   "version": "3.50.0",
   "declared": {
    "postinstall": "node -e \"try{require('./postinstall')}catch(e){}\""
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 2.7
  },
  {
   "rank": 1253,
   "package": "unrs-resolver",
   "version": "1.12.2",
   "declared": {
    "postinstall": "node postinstall.js"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 4.5
  },
  {
   "rank": 1264,
   "package": "@swc/core",
   "version": "1.16.13",
   "declared": {
    "postinstall": "node postinstall.js"
   },
   "verdict": "manual_review",
   "reasonCode": "step_timed_out",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node",
     "npm"
    ],
    "truncated": false
   },
   "seconds": 17.8
  },
  {
   "rank": 1514,
   "package": "fsevents",
   "version": "2.3.3",
   "declared": {
    "install": "node-gyp rebuild"
   },
   "verdict": "manual_review",
   "reasonCode": "no_install_steps",
   "installSteps": [],
   "observed": null,
   "seconds": 1.5
  },
  {
   "rank": 1580,
   "package": "@parcel/watcher",
   "version": "2.6.0",
   "declared": {
    "install": "node scripts/build-from-source.js"
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "install"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 2.1
  },
  {
   "rank": 2007,
   "package": "core-js-pure",
   "version": "3.50.0",
   "declared": {
    "postinstall": "node -e \"try{require('./postinstall')}catch(e){}\""
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 3.7
  },
  {
   "rank": 2079,
   "package": "@sentry/cli",
   "version": "3.8.0",
   "declared": {
    "postinstall": "node ./scripts/install.js"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 3.2
  },
  {
   "rank": 2185,
   "package": "msgpackr-extract",
   "version": "3.0.4",
   "declared": {
    "install": "node-gyp-build-optional-packages"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "install"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [],
    "truncated": false
   },
   "seconds": 2.0
  },
  {
   "rank": 2265,
   "package": "node-pty",
   "version": "1.1.0",
   "declared": {
    "install": "node scripts/prebuild.js || node-gyp rebuild",
    "postinstall": "node scripts/post-install.js"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "install",
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [
     "python",
     "python3"
    ],
    "network": [],
    "programs": [
     "node",
     "node-gyp"
    ],
    "truncated": false
   },
   "seconds": 14.1
  },
  {
   "rank": 2403,
   "package": "es5-ext",
   "version": "0.10.64",
   "declared": {
    "postinstall": " node -e \"try{require('./_postinstall')}catch(e){}\" || exit 0"
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 3.2
  },
  {
   "rank": 2725,
   "package": "puppeteer",
   "version": "25.13.0",
   "declared": {
    "postinstall": "node install.mjs"
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 2.5
  },
  {
   "rank": 2767,
   "package": "@google/genai",
   "version": "2.28.0",
   "declared": {
    "preinstall": "echo 'preinstall: no-op'"
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "preinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [],
    "truncated": false
   },
   "seconds": 3.0
  },
  {
   "rank": 2817,
   "package": "@firebase/util",
   "version": "1.15.3",
   "declared": {
    "postinstall": "node ./postinstall.js"
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 4.3
  },
  {
   "rank": 2895,
   "package": "aws-sdk",
   "version": "2.1693.0",
   "declared": {
    "postinstall": "node scripts/warn-maintenance-mode.js"
   },
   "verdict": "manual_review",
   "reasonCode": "extract_failed",
   "installSteps": [],
   "observed": null,
   "seconds": 12.2
  },
  {
   "rank": 2933,
   "package": "yarn",
   "version": "1.22.22",
   "declared": {
    "preinstall": ":; (node ./preinstall.js > /dev/null 2>&1 || true)"
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "preinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 4.1
  },
  {
   "rank": 2995,
   "package": "nx",
   "version": "23.3.0",
   "declared": {
    "postinstall": "node -e \"try{require('./dist/bin/post-install')}catch(e){}\""
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 5.7
  },
  {
   "rank": 3068,
   "package": "@anthropic-ai/claude-code",
   "version": "2.1.295",
   "declared": {
    "postinstall": "node install.cjs"
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 3.2
  },
  {
   "rank": 3154,
   "package": "@scarf/scarf",
   "version": "1.4.0",
   "declared": {
    "postinstall": "node ./report.js"
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node",
     "npm"
    ],
    "truncated": false
   },
   "seconds": 8.4
  },
  {
   "rank": 3287,
   "package": "ssh2",
   "version": "1.17.0",
   "declared": {
    "install": "node install.js"
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "install"
   ],
   "observed": {
    "dns": [],
    "missing": [
     "python",
     "python3"
    ],
    "network": [],
    "programs": [
     "node",
     "node-gyp"
    ],
    "truncated": false
   },
   "seconds": 8.2
  },
  {
   "rank": 3338,
   "package": "cypress",
   "version": "16.1.1",
   "declared": {
    "postinstall": "node dist/index.js --exec install"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 3.8
  },
  {
   "rank": 3410,
   "package": "cpu-features",
   "version": "0.0.10",
   "declared": {
    "install": "node buildcheck.js > buildcheck.gypi && node-gyp rebuild"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "install"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 2.6
  },
  {
   "rank": 3441,
   "package": "vue-demi",
   "version": "0.14.10",
   "declared": {
    "postinstall": "node -e \"try{require('./scripts/postinstall.js')}catch(e){}\""
   },
   "verdict": "approved",
   "reasonCode": "ran_ok",
   "installSteps": [
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 3.1
  },
  {
   "rank": 3456,
   "package": "canvas",
   "version": "3.2.3",
   "declared": {
    "install": "prebuild-install -r napi || node-gyp rebuild"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "install"
   ],
   "observed": {
    "dns": [],
    "missing": [
     "python",
     "python3"
    ],
    "network": [],
    "programs": [
     "node",
     "node-gyp"
    ],
    "truncated": false
   },
   "seconds": 4.5
  },
  {
   "rank": 3537,
   "package": "bufferutil",
   "version": "4.1.0",
   "declared": {
    "install": "node-gyp-build"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "install"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [],
    "truncated": false
   },
   "seconds": 1.7
  },
  {
   "rank": 3593,
   "package": "utf-8-validate",
   "version": "6.0.6",
   "declared": {
    "install": "node-gyp-build"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "install"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [],
    "truncated": false
   },
   "seconds": 2.0
  },
  {
   "rank": 3812,
   "package": "union",
   "version": "0.6.0",
   "declared": {
    "preinstall": "npx npm-force-resolutions"
   },
   "verdict": "manual_review",
   "reasonCode": "step_timed_out",
   "installSteps": [
    "preinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node",
     "npx"
    ],
    "truncated": false
   },
   "seconds": 17.6
  },
  {
   "rank": 3866,
   "package": "@pnpm/exe",
   "version": "12.10.1",
   "declared": {
    "preinstall": "node install.js",
    "postinstall": "node install.js"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "preinstall",
    "postinstall"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [
     "node"
    ],
    "truncated": false
   },
   "seconds": 2.6
  },
  {
   "rank": 3972,
   "package": "lmdb",
   "version": "3.5.7",
   "declared": {
    "install": "node-gyp-build-optional-packages"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "install"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [],
    "truncated": false
   },
   "seconds": 2.1
  },
  {
   "rank": 4077,
   "package": "bcrypt",
   "version": "6.0.0",
   "declared": {
    "install": "node-gyp-build"
   },
   "verdict": "manual_review",
   "reasonCode": "install_step_failed",
   "installSteps": [
    "install"
   ],
   "observed": {
    "dns": [],
    "missing": [],
    "network": [],
    "programs": [],
    "truncated": false
   },
   "seconds": 2.1
  }
 ]
}