passport

npm · Rank #179 of 217

72 / 100 C

STALE — No release in 928 days. Stale packages accumulate unpatched vulnerabilities.

npm publisher

Single point of failure

downloads/week

Blast radius if compromised

14.7y

package age

Established package

928 days ago

last release

Possibly unmaintained

Risk analysis

passport is flagged HIGH risk due to rapid adoption with limited publisher depth. New packages with fast growth are higher-risk targets.

Publisher depth — How many people can push to npm? Single-publisher packages are the #1 structural risk.
Longevity — Older packages have track records. New packages with high adoption are higher risk.
Release consistency — Regular releases signal active oversight. Long gaps mean unpatched vulnerabilities.
Download trend — Growing packages attract more scrutiny (and more attacks).
OpenSSF Scorecard — Process security: branch protection, code review, CI/CD safety.

You came looking for passport. Your node_modules has hundreds more. Run one command to score every dependency you ship:

npx proof-of-commitment

Auto-detects your lockfile. Scores every dependency. Zero install.

![Commit Trust](https://getcommit.dev/badge/npm/passport)