Add the badge to your README
 chai has a single npm publisher and 84M weekly downloads. This is the exact structural profile exploited in the axios and LiteLLM supply chain attacks: one compromised credential would expose every downstream project.
A CRITICAL flag means this package has the structural preconditions for a supply chain attack — not that an attack is happening. Both axios (score 86) and chalk (score 75) are flagged CRITICAL. They're well-maintained. They're also one stolen credential away from a repeat of the March 2026 attacks.
The flag surfaces a fact: 1 person can push code to 84M machines per week. Whether that's a problem depends on your risk tolerance.
Every version goes through a staging area before going live. The maintainer must explicitly approve it with 2FA. This is the strongest protection npm offers against credential theft attacks — even stolen CI tokens can't push code to production.
npm publish and going live.
You came looking for chai. Your node_modules has hundreds more.
Some of them have the same single-publisher profile.
Run one command to score every dependency you ship:
npx proof-of-commitment Auto-detects your lockfile. Scores every dependency. Zero install.
