npm package commitment scores: zod has 139M weekly downloads and one maintainer

The author built a Proof of Commitment scorer that rates npm packages by behavioral signals across five dimensions.

A dataset of nine core JS/TS packages shows zod and axios have very high weekly downloads while each lists one maintainer.

Single-maintainer, high-download packages increase supply-chain risk because a stolen CI/npm token can enable malicious publishes.

The scoring tool does not measure publish-pipeline security such as token scoping or MFA; provenance tools remain necessary.