npm package trust score

drizzle-orm

npm · 9M/week · 4.7 years old

84/ 100

SAFE

npm publishers4

Weekly downloads9M

Package age4.7 years

Last published47d ago

GitHub contributors35

ProvenanceYes

OpenSSF Scorecard—

GradeA

Score breakdown

Five behavioral dimensions. Each measured from public registry data, not self-reported.

Longevity

20/25

Download momentum

22/25

Release consistency

18/20

Publisher depth

11/15

GitHub backing

11/15

What this score measures

The Commit trust score measures behavioral commitment — signals that are hard to fake. Unlike stars, READMEs, or download counts, these signals capture how a package is actually maintained.

Longevity — how long the package has been published and actively maintained
Publisher depth — number of people with npm publish access (distinct from GitHub contributors)
Release consistency — regular releases signal active oversight
Download trend — growing, stable, or declining adoption
GitHub backing — contributor depth and OpenSSF Scorecard process security

Use this data

Audit your full dependency tree Add to your CI pipeline

CLI

npx proof-of-commitment drizzle-orm

MCP (Claude, Cursor, Windsurf)

{ "mcpServers": { "commit": { "type": "streamable-http", "url": "https://poc-backend.amdal-dev.workers.dev/mcp" } } }

README badge

![Commit Trust](https://poc-backend.amdal-dev.workers.dev/badge/npm/drizzle-orm)

REST API

curl -X POST https://poc-backend.amdal-dev.workers.dev/api/audit -H "Content-Type: application/json" -d '{"packages":["drizzle-orm"]}'