← All comparisons

Scorecard scores the process.
Commit scores the risk.

OpenSSF Scorecard evaluates whether a project follows secure development practices — branch protection, CI/CD, signed releases, fuzzing. It's the best tool for measuring process security. It doesn't measure who controls the npm publish token or what happens if they're compromised.

↓ Scorecard requires a GitHub repository. 23% of npm packages with >1M weekly downloads have no linked GitHub repo — for these, Scorecard returns no data. Commit scores them regardless.

Different security layers

OpenSSF Scorecard

Measures process security

Catches

  • Branch protection and code review requirements
  • CI/CD configuration and SAST
  • Signed releases and SLSA provenance
  • Fuzzing and token permissions
  • Dangerous workflow detection

Misses

  • Who controls the npm publish token
  • Download volume vs maintainer count
  • npm-only packages (no GitHub repo)
  • Transitive dependency risk
Commit

Measures structural risk

Catches

  • Publisher concentration (credential risk)
  • Download volume vs maintainer ratio
  • All ecosystems (npm, PyPI, Cargo, Go)
  • Full transitive dependency tree
  • Packages without GitHub repos

Misses

  • Repository security practices
  • Whether CI/CD is configured correctly
  • Code review enforcement
  • SLSA provenance tracking
Scorecard tells you "this project follows security best practices." Commit tells you "if those practices fail, how bad is the blast radius?" Both questions matter.

Case study: esbuild

esbuild is a model of disciplined open source. Single author, rigorous engineering, excellent documentation. Scorecard reflects this: good CI, consistent releases, careful dependency management. Commit flags it CRITICAL for a completely orthogonal reason.

Scorecard says
8.2 Good practices
  • CI/CD configured
  • Consistent release cadence
  • Branch protection active
  • No dangerous workflows
Commit says
88 CRITICAL
  • 1 npm publisher
  • 194M downloads/week
  • 8.4 years old
  • No provenance attestation

The CRITICAL flag isn't a judgment on Evan Wallace's engineering discipline — it's a measurement of ecosystem structure. One compromised account reaches 194 million weekly installs. That's not a process problem; it's a concentration problem. Scorecard can tell you the processes are good. It can't tell you what happens when those processes are bypassed.

The two blind spots

Packages without GitHub repos

Scorecard is GitHub-first. It can't score a package that lives only on npm. Roughly 23% of high-download npm packages have no linked repository. For these, Scorecard returns nothing. Commit scores them using registry metadata: publisher count, release history, download trends.

Publisher concentration at scale

A package can have exemplary Scorecard results — branch protection, signed commits, SLSA Level 2 — and still have a single person controlling the npm publish token for 400M weekly downloads. Scorecard doesn't measure that. Commit does. And it's the measurement that predicts which packages get attacked.

Six attacks in 2026. Good Scorecard scores didn't help.

Mar 30
axios Token theft. 1 publisher, 119M downloads/week. Repository had reasonable practices. Attack bypassed all process controls via stolen credentials.
May 11
TanStack CI/CD hijacking. Compromised GitHub Actions. CI was configured — but the configuration itself became the attack vector.
May 22
TrapDoor 21 packages. Planted persistence hooks in IDE configs. Targeted AI coding assistants. Novel enough to evade process-based detection.
Jun 1
Red Hat / Miasma 32 packages via compromised GitHub account. Valid SLSA provenance on every malicious version. Perfect Scorecard attestation. The process worked exactly as designed — on malicious code.
Jun 3
Phantom Gyp 57 packages using binding.gyp bypass. Self-propagating worm in the Shai-Hulud lineage. Scorecard checks didn't catch the binding.gyp vector.
Jun 4
IronWorm 37 packages with eBPF rootkit. First npm supply chain attack with kernel-level persistence. Process integrity checks had no visibility into post-install behavior.
The Red Hat / Miasma attack is the clearest example: every malicious version had valid SLSA provenance. Scorecard would have rated the project highly throughout the attack. Structural signals — concentrated publish authority — were the only pre-attack indicators available.

Audit your full supply chain

Five packages. Scorecard scores shown where available. Commit: live behavioral risk data.

Package
Scorecard Process security (0–10)
Commit Structural risk score

Loading live Commit data…

CRITICAL single publisher + >10M downloads/week · OK healthy structural signals

Frequently asked

Does a high Scorecard score mean a package is safe?

No. Scorecard measures process. The Red Hat / Miasma attack (Jun 1, 2026) had valid SLSA provenance on every malicious version — Scorecard would have rated those packages highly throughout the attack. Process integrity is necessary but not sufficient. Structural concentration is a separate risk axis that Scorecard doesn't cover.

Can I use Commit instead of running Scorecard?

No. They measure orthogonal things. Scorecard tells you whether a project enforces code review, uses signed commits, and has CI configured. Commit tells you how many people control the publish credentials and whether that's proportionate to the download volume. A complete supply chain security posture needs both: Scorecard for process integrity, Commit for structural exposure.

Why doesn't Scorecard catch publisher concentration?

It's not in scope. Scorecard was designed to measure repository security practices — things a project team controls. Publisher concentration is an ecosystem-level observation: how many people have the credentials to push to npm, and does that number make sense relative to the install volume? Scorecard answers "does this project have good security hygiene?" Commit answers "is this package's attack surface proportionate to its blast radius?"

Is Commit free?

The CLI, web audit, and API are free. Paid plans from $15–$29/mo add batch scanning, continuous monitoring, Slack/webhook alerts, and GitHub Action integration. See pricing →

Audit your full supply chain

Scorecard covers GitHub repos. Commit covers everything — including the 23% of high-download packages with no linked repo.

Run a free audit → Get a free API key
npx proof-of-commitment --file package.json