Researchers analyzed install scripts in npm's 5,000 most-downloaded packages and found only 31 (0.6%) execute code during installation. Most packages that declare install scripts either complete without network access, fail due to missing build dependencies, or timeout while attempting to fetch binaries. The concentrated list of packages with install-time code is small enough for manual review.