npm package trust score

sequelize

npm · 2M/week · 15.4 years old

76/ 100

HIGH

npm publishers9

Weekly downloads2M

Package age15.4 years

Last published215d ago

GitHub contributors35

SLSA provenanceNo

Trusted PublishingNo

OpenSSF Scorecard6.8/10

GradeB

Risk flags

HIGH: sole active npm publisher + >1M/wkWARN: 7 dormant publishers with current scope access — mickhansen (119mo inactive), felixfbecker (110mo inactive), janaameier (104mo inactive), eseliger (91mo inactive), sushantdhiman (73mo inactive), papb (56mo inactive), sdepold (18mo inactive)

Score breakdown

Five behavioral dimensions. Each measured from public registry data, not self-reported.

Longevity

25/25

Download momentum

18/25

Release consistency

16/20

Publisher depth

2/15

GitHub backing

15/15

Trusted Publishing

0/2

What this score measures

The Commit trust score measures behavioral commitment — signals that are hard to fake. Unlike stars, READMEs, or download counts, these signals capture how a package is actually maintained.

Longevity — how long the package has been published and actively maintained
Publisher depth — number of people with npm publish access (distinct from GitHub contributors)
Release consistency — regular releases signal active oversight
Download trend — growing, stable, or declining adoption
GitHub backing — contributor depth and OpenSSF Scorecard process security
Trusted Publishing — whether the package uses npm OIDC provenance to publish from CI, eliminating stolen-credential attacks

Track this package

Monitor sequelize in CI. Catch risk changes before they reach production.

Track sequelize → Compare plans →

Free: 200 audits/day · Paid from Developer ($15/mo): monitoring, batch API, email alerts

Use this data

Audit your full dependency tree Add to your CI pipeline

CLI

npx proof-of-commitment sequelize

MCP (Claude, Cursor, Windsurf)

{ "mcpServers": { "commit": { "type": "streamable-http", "url": "https://poc-backend.amdal-dev.workers.dev/mcp" } } }

README badge

![Commit Trust](https://poc-backend.amdal-dev.workers.dev/badge/npm/sequelize)

REST API

curl -X POST https://poc-backend.amdal-dev.workers.dev/api/audit -H "Content-Type: application/json" -d '{"packages":["sequelize"]}'