You've probably never heard of these npm packages. They're in your production app.

Everyone knows about chalk (422M weekly downloads, 1 maintainer) and axios (100M/wk, 1 maintainer — compromised March 30, 2026). Those are in your package.json . You chose them. But when we ran the 113 most-downloaded npm packages through proof-of-commitment today, the packages that surprised me weren't the ones developers deliberately install. They were the invisible ones — the load-bearing infrastructure nobody chose, nobody monitors, and nobody thinks about. glob: 340 million weekly downloads