proof-of-commitment 1.31.0 → 1.31.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +18 -0
  2. package/package.json +8 -1
package/README.md CHANGED
@@ -6,6 +6,24 @@
6
6
 
7
7
  An MCP server and web tool that scores npm packages, PyPI packages, Rust crates, Go modules, and GitHub repos on **behavioral commitment** — signals that are harder to fake than stars, READMEs, or download counts.
8
8
 
9
+ ```text
10
+ $ npx proof-of-commitment axios zod chalk lodash minimatch
11
+ Scoring 5 npm packages... done in 3.0s
12
+
13
+ Package Risk Score Publishers Downloads Age Provenance
14
+ chalk 🔴 CRITICAL 72 1 432.9M/wk 14.6y —
15
+ minimatch 🔴 CRITICAL 78 1 634.1M/wk 14.9y —
16
+ lodash 🔴 CRITICAL 80 1 158.9M/wk 14.1y —
17
+ zod 🔴 CRITICAL 83 1 161.2M/wk 6.3y 🔐 verified
18
+ axios 🔴 CRITICAL 88 1 115.7M/wk 11.8y 🔐 verified
19
+ ⚠ COMPROMISED — axios token theft (2026-03-30)
20
+
21
+ ⚠ 5 CRITICAL packages found.
22
+ CRITICAL = sole npm publisher + >10M weekly downloads (publish-access concentration risk)
23
+ ```
24
+
25
+ `npm audit` flags none of these. They're not vulnerabilities — they're attack-surface concentration. One stolen npm token, one phished maintainer, and a single push reaches the whole ecosystem (axios, March 30 2026 — happened).
26
+
9
27
  ## The supply chain security problem
10
28
 
11
29
  26 of the 91 npm packages with >10M weekly downloads have a **single npm publisher**. Together they account for over 3 billion downloads per week. `npm audit` doesn't surface this. Stars don't either.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "proof-of-commitment",
3
- "version": "1.31.0",
3
+ "version": "1.31.1",
4
4
  "mcpName": "io.github.piiiico/proof-of-commitment",
5
5
  "description": "Supply chain security risk scorer for npm, PyPI, Cargo, and Go packages — behavioral signals that can't be faked",
6
6
  "type": "module",
@@ -53,6 +53,13 @@
53
53
  "url": "https://github.com/piiiico/proof-of-commitment"
54
54
  },
55
55
  "homepage": "https://getcommit.dev/audit",
56
+ "bugs": {
57
+ "url": "https://github.com/piiiico/proof-of-commitment/issues"
58
+ },
59
+ "funding": {
60
+ "type": "individual",
61
+ "url": "https://getcommit.dev/pricing?utm_source=npm-fund&utm_medium=package-meta"
62
+ },
56
63
  "engines": {
57
64
  "node": ">=18"
58
65
  }