We traced the install scripts of NPM's 5k most-downloaded packages

Good point that testing a package without its dependency context misses things. Did you try measuring how install behavior changes when a package is installed transitively?