The Structural Risk of Invisible npm Infrastructure: Single-Maintainer Packages in Production

You’ve probably never heard of these npm packages. They’re in your production app.

A recent proof-of-commitment audit of the 113 most-downloaded npm packages reveals 26 packages with critical structural risks. On March 30, 2026, the axios package was compromised by a North Korea-linked group via a stolen npm token, affecting 100 million weekly downloads.

Why This Matters

The security of the global software supply chain frequently rests on the credentials of single individuals managing ‘load-bearing’ infrastructure like glob and cross-spawn. While engineering teams prioritize top-level dependencies, the technical reality is that transitive dependencies pull in critical code that remains unmonitored and unvetted by automated tools like npm audit.

Key Insights

• The glob package, essential for Webpack, Jest, and TypeScript, serves 340 million weekly downloads with a single maintainer for over 13 years.
• The cross-spawn package, used by npm and yarn for Windows child process spawning, recorded 190 million weekly downloads under one maintainer as of April 2026.
• Build-time dependencies like @types/node serve 316 million weekly downloads and pose significant risks to CI/CD pipelines and Docker build environments.
• The 26 packages identified as CRITICAL represent 10.3 billion weekly downloads, all managed by sole maintainers with structural risk scores between 64 and 88.
• Historical vulnerabilities in ua-parser-js (CVE-2021-41265) highlight how sole-maintainer credentials are the primary barrier to malicious build-time execution.

Working Examples

Scanning a specific package for risk scores and maintainer counts.

npx proof-of-commitment glob

Running an audit against a resolved dependency tree to find hidden critical risks.

npx proof-of-commitment --file package-lock.json

Practical Applications

• Audit resolved dependency trees using proof-of-commitment to identify transitive single-maintainer bottlenecks that npm audit ignores.
• Pitfall: Assuming that TypeScript types are safe from runtime impact, whereas they can compromise the CI/CD pipeline during build-time installation.
• Implement monitoring for build-time environment variables and network activity to mitigate risks from compromised infrastructure packages like cross-env or ejs.

References:

• https://dev.to/piiiico/youve-probably-never-heard-of-these-npm-packages-theyre-in-your-production-app-27hi
• https://getcommit.dev/rankings
• https://getcommit.dev/audit