← All comparisons

Snyk scores chalk 81.
We score it CRITICAL.

Snyk's Package Health Score evaluates code quality, maintenance activity, and community engagement. It gives chalk 81/100 — healthy. Chalk has one npm publisher controlling 445 million downloads per week. That's the exact attack profile exploited in every major 2026 npm supply chain incident.

↓ 26 of the 91 npm packages with >10M weekly downloads have a single npm publisher. Together they account for over 3 billion downloads per week. Snyk flags none of them.
Related: Why Snyk scores chalk 81 and we score it CRITICAL →

Different tools, different blind spots

Snyk

Catches what's broken

Catches

  • Known CVEs in NVD
  • Exploit availability & severity
  • Fix guidance / upgrade paths
  • License compliance
  • Container image scanning

Misses

  • Who controls the npm publish token
  • Publisher count vs download volume
  • Whether the next attack is structurally likely
Commit

Catches what's exposed

Catches

  • Publisher concentration
  • Download volume vs maintainer ratio
  • Release consistency / cadence
  • Full transitive dependency tree
  • OpenSSF Scorecard integration

Misses

  • Known CVEs / published exploits
  • Malicious code patterns
  • License compliance
Use both. Snyk tells you "this version has a known vulnerability." Commit tells you "this package is the kind of thing that gets targeted next."

Case study: chalk

Snyk says
81 Healthy
  • Active maintenance
  • Good community engagement
  • No known CVEs
  • Regular releases
Commit says
72 CRITICAL
  • 1 npm publisher
  • 445M downloads/week
  • 14.6 years old
  • No provenance attestation

Chalk is excellent software. The CRITICAL flag isn't about code quality — it's about credential concentration. One stolen npm token, one compromised laptop, one phishing email reaches every project that depends on chalk. That's 445 million installs per week behind a single set of credentials.

Six attacks in 2026. Same structural pattern.

Mar 30
axios Token theft. 1 publisher, 119M downloads/week. Snyk: no CVE beforehand. Commit: CRITICAL.
May 11
TanStack CI/CD hijacking. Compromised GitHub Actions published malicious versions. Commit: CRITICAL.
May 22
TrapDoor 21 packages. Planted persistence hooks in IDE configs. Targeted AI coding assistants.
Jun 1
Red Hat / Miasma 32 packages via compromised GitHub account. Valid SLSA provenance on every malicious version.
Jun 3
Phantom Gyp 57 packages using binding.gyp bypass. Self-propagating worm in the Shai-Hulud lineage.
Jun 4
IronWorm 37 packages with eBPF rootkit. First npm supply chain attack with kernel-level persistence.
npm audit and Snyk flagged zero of these beforehand. All had structural signals Commit would have surfaced.

Snyk says healthy. Commit says CRITICAL.

Five packages. Live Commit data. Snyk Package Health scores shown as-of analysis.

Package
Snyk Package Health Score
Commit Behavioral risk score

Loading live data…

CRITICAL single publisher + >10M downloads/week · OK healthy structural signals

Frequently asked

Should I replace Snyk with Commit?

No. They measure different things. Snyk tracks known CVEs and gives you fix paths — that's irreplaceable. Commit measures structural exposure: credential concentration, publisher count vs download volume, release patterns. A dependency can have zero CVEs and still be CRITICAL on Commit because one person controls 400M weekly installs. Use both.

What does Package Health Score measure that Commit doesn't?

Community engagement, maintenance activity, code quality signals, and known CVEs. Snyk's model answers "is this package well-maintained and free of known vulnerabilities?" That's a completely different question from "is this package's publish access concentrated in a way that makes it a high-value target?"

Why does Snyk give chalk 81 if it has 1 publisher?

Because publisher concentration isn't in Snyk's model. Snyk measures what it's designed to measure — code quality, maintenance activity, CVE coverage. It has no signal for "one set of credentials controls 445M downloads/week." That's a gap, not a flaw. Different tools, different scope.

Is Commit free?

The CLI, web audit, and API are free. Paid plans from $15–$29/mo add batch scanning, continuous monitoring, Slack/webhook alerts, and GitHub Action integration. See pricing →

Check what Snyk misses

Paste your dependencies. See which ones are structurally exposed.

Run a free audit → Get a free API key
npx proof-of-commitment --file package.json