I audited 25 top npm packages with a zero-install CLI. Here's who passes.

npx proof-of-commitment react zod chalk lodash axios typescript That's it. No install, no API key, no account. Run it against any package — or drop your package.json at getcommit.dev/audit . I ran it against 25 of the most downloaded npm packages. Here's what the data shows — and the results are worse than I expected. The scoring model Five behavioral dimensions, all from public registry data: Dimension Max What it measures Longevity 25 Package age — time in production is signal Download Momentu