State of npm Supply Chain Trust: April 2026

Executive Summary

15 of the top 50 npm packages by weekly downloads are CRITICAL — meaning a single person's npm token is the only barrier between those packages and a supply chain compromise. Combined, those 15 packages receive 2.54 billion weekly downloads, representing 34% of all downloads across the top 50.

The packages that passed include webpack (score=100, 8 maintainers), prettier (score=100, 11 maintainers), and TypeScript (score=98, 6 maintainers). The packages that are CRITICAL include minimatch (562M downloads/week, 1 maintainer), chalk (413M downloads/week, 1 maintainer), and glob (332M downloads/week, 1 maintainer).

Here's the uncomfortable part: every single package scores above 70 on structural metrics. The behavioral signals look fine. Release cadence looks fine. Download momentum looks fine. The risk is invisible to any metric that doesn't explicitly flag single-maintainer concentration at scale — which is exactly what npm audit doesn't do.

This is the same structural profile that the ua-parser-js attack exploited in October 2021. A single token. A window. A malicious publish. Cryptominer and credential stealer deployed to 7 million weekly downloads before anyone noticed. axios carries the same profile at 82 million weekly downloads.

---

The Full Dataset

Audited April 18, 2026 via proof-of-commitment. CRITICAL = 1 maintainer + >10M weekly downloads.

Data: JSON dataset — proof-of-commitment API, April 18 2026. Try it: npx proof-of-commitment <package-name>

---

Score Distribution

Here's what the structural scores look like across the 50 packages — and why the score alone is insufficient:

The uncomfortable finding: scores look fine. The risk is hiding in the CRITICAL flag. Every package in the top 50 scores 70 or above — solidly in the "healthy" zone by behavioral metrics. Release cadence, longevity, and download momentum all look reasonable. The danger isn't in the scores.

It's in the 15 packages where a single npm token is the only barrier between those downloads and a supply chain compromise.

---

The CRITICAL List

These are the 15 packages where one person's credentials control access for millions of developers. Sorted by blast radius (weekly downloads).

Total: 2.54 billion weekly downloads, controlled by 15 individual npm tokens.

---

Risk Categories

1. Infrastructure utilities nobody thinks about

minimatch, glob, and debug are in this category. They're not glamorous packages — they're the plumbing. minimatch is what npm itself uses to match package names. glob is what test runners use to find test files. debug is what Express, Mongoose, and nearly every server framework uses for internal logging. Nobody writes blog posts about them. They're just there, in everything, downloaded 500+ million times a week each.

All three: one maintainer.

2. The famous singletons

Chalk, lodash, axios, zod, esbuild. These are the packages developers know by name. Chalk colors your terminal. Lodash is your utility belt. Axios is your HTTP client. Zod validates your API shapes. esbuild makes your builds fast. They're recommended in tutorials, listed in starter templates, referenced in documentation everywhere.

Each one: one maintainer.

The ua-parser-js case is instructive. The behavioral score was high — well-maintained, active, consistent releases. The structural flag was there for years before the October 2021 attack. npm audit showed nothing. The attack took a compromised token and four hours. The blast radius included Facebook, Microsoft, Amazon, and Google. axios carries an identical structural profile at 12x the download volume.

3. TypeScript ecosystem bottlenecks

@types/node and @types/jest are maintained by a single contributor each through DefinitelyTyped, the community type repository. Every TypeScript project that touches Node.js APIs installs @types/node. Every project using Jest for testing has @types/jest in its dev dependencies. These packages don't ship runtime code — they ship type definitions. But a malicious publish could inject incorrect type definitions that cause type-checking to miss real vulnerabilities, or include a postinstall script with arbitrary code execution.

4. Dev toolchain and CI exposure

chokidar, nodemon, and cross-env run in development environments and CI pipelines. They have process-level access. chokidar watches file system events — it's in Webpack and Vite. nodemon restarts your server on file changes — it executes code directly. cross-env sets environment variables at build time — it runs in CI with full access to secrets.

These packages are less likely to be in production images, but CI pipeline compromise is increasingly the attack target. The CodeCov incident (2021), the XZ Utils attack (2024) — build toolchain is the new attack surface.

---

The Packages That Passed

The safe packages earn it through demonstrated commitment over time — not certification, not promises.

• prettier (score=100, 11 maintainers, 87M/wk) — The most maintained package in the top 50 by active contributor count. Consistent weekly releases. 11 people with publish access means 11 tokens would need to be compromised simultaneously.
• webpack (score=100, 8 maintainers, 44M/wk) — 14 years of shipping. 8 maintainers. Behavioral record that predates most of its users.
• semver (score=95, 5 maintainers, 633M/wk) — The most-downloaded safe package. 15 years old, 5 maintainers, consistent release record. npm's versioning backbone, done right.
• typescript (score=98, 6 maintainers, 178M/wk) — Microsoft-backed, 6 maintainers, 14 years of behavioral record. The structural antithesis of esbuild (also from the JS toolchain, 5x fewer maintainers).
• tslib (score=89, 6 maintainers, 357M/wk) — Also Microsoft-backed TypeScript infrastructure. 6 maintainers, strong release cadence. Not the headline package, but well-governed.

---

What You Can Do

The gap between the packages that passed and the ones that are CRITICAL isn't code quality — it's governance structure. Chalk is high-quality code. So is zod. So is esbuild. The risk isn't in the implementation; it's in the single point of failure for publish access.

That's a solvable problem — but only if you can see it.

Audit your stack in 30 seconds:

npx proof-of-commitment axios zod chalk hono esbuild
# Or against your whole project:
npx proof-of-commitment --file package.json

Add to CI (posts table directly on your PR):

- uses: piiiico/proof-of-commitment@main
  with:
    fail-on-critical: false
    comment-on-pr: true

MCP server (works with Claude Desktop, Cursor, Windsurf):

{
  "mcpServers": {
    "proof-of-commitment": {
      "type": "streamable-http",
      "url": "https://poc-backend.amdal-dev.workers.dev/mcp"
    }
  }
}

Then: "Audit the dependencies in vercel/ai" — it fetches the package.json, scores everything, returns a risk table.

Web interface: getcommit.dev/audit — paste packages or drop your package.json.

---

Methodology

All data sourced from public npm registry and GitHub APIs via proof-of-commitment. Five behavioral dimensions, all from observable signals:

CRITICAL = 1 maintainer + >10M weekly downloads. This is the exact profile that the ua-parser-js attack (October 2021) and event-stream (2018) exploited. High download count means high value target. Single maintainer means one token to compromise.

This analysis does not replace npm audit — it answers a different question. npm audit scans for known CVEs in the NVD database. proof-of-commitment scores structural resilience: would this package survive a maintainer compromise, a token theft, or a gradual abandonment?

The ua-parser-js attack had zero CVE warnings. Zero npm audit flags. It had a structural flag for years. The same is true for axios, minimatch, chalk, and the other CRITICAL packages in this dataset — right now.

Download the raw dataset: github.com/piiiico/proof-of-commitment · Run your own audit: npx proof-of-commitment --file package.json · getcommit.dev/audit

We're building Commit — trust infrastructure for the autonomous economy. Behavioral commitment data, not declarations. Source: github.com/piiiico/proof-of-commitment.

See also: Benchmarks Lied. Now What? · The Missing Layer · Declarations Are Gameable