Over the past two weeks I've scanned the most-downloaded packages in four major ecosystems using Proof of Commitment — the same behavioral scoring tool, the same methodology, applied to npm, PyPI, Cargo, and Go.

The individual findings are striking. The cross-ecosystem pattern is damning.

The scoreboard

I audited the 20 most-downloaded packages in each registry-based ecosystem (npm, PyPI, Cargo) and 10 top Go modules. A package scores CRITICAL when it has a sole publish-credential holder and high download volume — the structural preconditions for a credential-compromise supply chain attack.

Ecosystem Scanned CRITICAL Rate CRITICAL downloads/wk

npm 20 10 50% ~2.4B

PyPI 20 10 50% ~2.6B

Cargo 20 12 60% ~176M

Go 10 0 0% —

Combined across npm, PyPI, and Cargo: roughly 5.2 billion weekly downloads flow through packages where a single compromised credential could push malicious code.

The worst in each ecosystem

npm: 2.4 billion downloads/week behind sole publishers

Package Downloads/wk Publishers…