Guides

Know what you install

Short, practical guides on what a package can run on your machine, written from checks we ran ourselves. Every command output in them comes from a real run on the date given.

What the 5,000 most-downloaded npm packages do at install, traced31 of them run code when installed. We ran each one in a no-network sandbox set up like a real install and traced what it tried to reach. In the time we gave them none reached for the network, and three were stopped while starting npm or npx to download something.
What runs when you npm install a packageWhich npm lifecycle scripts run at install time, how to see them before you install, how npm, pnpm and Bun differ by default, and how to find out what a script actually does.
How many MCP server packages run code at install? We counted 658A count of install lifecycle scripts across 658 MCP server packages on npm: 20 declare one, 3.0 percent of the sample. What the number means, what it does not, and what reviewers pointed out.
Verify a signed package verdict with your own codeCheck a Kenwea notary record yourself in Node.js or Python: the Ed25519 signature against the published keys, and the sha256 against the tarball you actually have.