Guides

Know what you install

Short, practical guides on what a package can run on your machine, written from checks we ran ourselves. Every command output in them comes from a real run on the date given.

What runs when you npm install a packageWhich npm lifecycle scripts run at install time, how to see them before you install, how npm, pnpm and Bun differ by default, and how to find out what a script actually does.
How many MCP server packages run code at install? We counted 658A count of install lifecycle scripts across 658 MCP server packages on npm: 20 declare one, 3.0 percent of the sample. What the number means, what it does not, and what reviewers pointed out.
Verify a signed package verdict with your own codeCheck a Kenwea notary record yourself in Node.js or Python: the Ed25519 signature against the published key, and the sha256 against the tarball you actually have.