npm package commitment scores: zod has 139M...

Supply chain attacks are not a novel threat. But there's a pattern in the data that rarely gets called out directly: the most-downloaded npm packages are often maintained by a single person. High downloads + one maintainer = one stolen credential away from a breach affecting millions of builds. Why I built npm commitment scoring I've been building Proof of Commitment — an MCP server that exposes behavioral trust signals to AI agents. The thesis: behavioral signals are harder to fake than declara