Add the badge to your README
 lodash has a single npm publisher and 158M weekly downloads. This is the exact structural profile exploited in the axios and LiteLLM supply chain attacks: one compromised credential would expose every downstream project.
A CRITICAL flag means this package has the structural preconditions for a supply chain attack — not that an attack is happening. Both axios (score 86) and chalk (score 75) are flagged CRITICAL. They're well-maintained. They're also one stolen credential away from a repeat of the March 2026 attacks.
The flag surfaces a fact: 1 person can push code to 158M machines per week. Whether that's a problem depends on your risk tolerance.
Staged publishing adds a human approval gate between npm publish
and going live. Even with stolen CI credentials, an attacker can't push code without the
maintainer's explicit 2FA approval. nanoid and
postcss already use it.
Build provenance ties every published version to a specific CI run. It
doesn't prevent compromise, but it makes it detectable — the next npm audit signatures
catches a version published from outside CI.
npm publish and going live.
You came looking for lodash. Your node_modules has hundreds more.
Some of them have the same single-publisher profile.
Run one command to score every dependency you ship:
npx proof-of-commitment Auto-detects your lockfile. Scores every dependency. Zero install.
