proof-of-commitment 1.22.0 → 1.22.1

package/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * proof-of-commitment CLI v1.21.1
+ * proof-of-commitment CLI v1.22.1
  * Scores npm/PyPI/Cargo/Go packages on behavioral commitment signals.
  * Usage: npx proof-of-commitment [packages...] [options]
  */
@@ -272,9 +272,11 @@ function printTable(results, { totalScanned, totalCritical, lockfile } = {}) {
 
   let criticalInDisplay = 0;
   let provenanceCount = 0;
+  let compromisedCount = 0;
 
   for (const pkg of results) {
     const rc = riskColor(pkg.riskFlags, pkg.score);
+    if (pkg.compromised) compromisedCount++;
     const label = riskLabel(pkg.riskFlags, pkg.score);
     if (hasCritical(pkg.riskFlags)) criticalInDisplay++;
     if (pkg.hasProvenance) provenanceCount++;
@@ -310,6 +312,12 @@ function printTable(results, { totalScanned, totalCritical, lockfile } = {}) {
       console.log(clr(c.dim, `  ↳ ${ghCount} GitHub contributors — publish-access concentration risk despite active community`));
     }
 
+    // Recently compromised warning
+    if (pkg.compromised) {
+      const atk = pkg.compromised;
+      console.log(clr(c.red, `  ⚠ COMPROMISED — ${atk.attack} (${atk.date}) — ${atk.url}`));
+    }
+
     // Score breakdown if available
     if (pkg.scoreBreakdown) {
       const b = pkg.scoreBreakdown;
@@ -342,6 +350,11 @@ function printTable(results, { totalScanned, totalCritical, lockfile } = {}) {
     console.log('\n' + clr(c.green, `✓  No CRITICAL packages found${suffix}.`));
   }
 
+  if (compromisedCount > 0) {
+    console.log(clr(c.red + c.bold, `\n⚠  ${compromisedCount} package${compromisedCount > 1 ? 's' : ''} recently compromised in supply chain attacks.`));
+    console.log(clr(c.dim, '   Verify you are on clean versions. See URLs above for incident details.'));
+  }
+
   // Footer with web link + CI integration CTA
   const topPkgs = results.slice(0, 10).map(r => r.name).join(',');
   const utm = 'utm_source=cli&utm_medium=audit';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "proof-of-commitment",
-  "version": "1.22.0",
+  "version": "1.22.1",
   "mcpName": "io.github.piiiico/proof-of-commitment",
   "description": "Supply chain risk scorer for npm, PyPI, Cargo, and Go packages — behavioral signals that can't be faked",
   "type": "module",