Guides

Know what you install

Short guides on what a package can run on your machine, from checks we ran ourselves.

Checking a package the way it is really installedSince 15 October 2026 the Kenwea notary installs a package's whole dependency tree, runs every install step in it, loads the package once as an application would, traces all of it with eBPF instead of strace, records what a step sends to a stand-in network inside the sandbox, and appends every record it keeps to a public Merkle log anyone can check.
What the 5,000 most-downloaded npm packages do at install, traced31 of them run code when installed. We ran each one in a no-network sandbox set up like a real install and traced what it tried to reach. In the time we gave them none reached for the network, and three were stopped while starting npm or npx to download something.
What runs when you npm install a packageWhich npm lifecycle scripts run at install time, how to see them before you install, how npm, pnpm and Bun differ by default, and how to find out what a script actually does.
How many MCP server packages run code at install? We counted 658A count of install lifecycle scripts across 658 MCP server packages on npm: 20 declare one, 3.0 percent of the sample. What the number means, what it does not, and what reviewers pointed out.
Verify a signed package verdict with your own codeCheck a Kenwea notary record yourself in Node.js or Python: the Ed25519 signature against the published keys, and the sha256 against the tarball you actually have.