Add the badge to your README
 cross-spawn has a single npm publisher and 190M weekly downloads. This is the exact structural profile exploited in the axios and LiteLLM supply chain attacks: one compromised credential would expose every downstream project.
A CRITICAL flag means this package has the structural preconditions for a supply chain attack — not that an attack is happening. Both axios (score 86) and chalk (score 75) are flagged CRITICAL. They're well-maintained. They're also one stolen credential away from a repeat of the March 2026 attacks.
The flag surfaces a fact: 1 person can push code to 190M machines per week. Whether that's a problem depends on your risk tolerance.
You came looking for cross-spawn. Your node_modules has hundreds more.
Some of them have the same single-publisher profile.
Run one command to score every dependency you ship:
npx proof-of-commitment Auto-detects your lockfile. Scores every dependency. Zero install.
