Add proof-of-commitment — behavioral supply chain risk scoring

[piiiico]

What this adds

proof-of-commitment (github.com/piiiico/proof-of-commitment) — behavioral risk scoring for npm, PyPI, Rust, and Go packages.

Added to Supply chain specific tools section.

Why it belongs here

Most supply chain tools focus on known CVEs or SBOM generation. proof-of-commitment surfaces a different class of risk: behavioral anomalies that appear before a vulnerability is catalogued.

Key signals it scores:

• Single-publisher risk — 26 of the top 91 npm packages (>10M weekly downloads) have exactly 1 npm publisher. npm audit doesn't surface this.
• Publisher churn — sudden ownership changes on high-download packages (as seen in the axios March 2026 attack)
• Install-time script anomalies — postinstall scripts added after a long clean history
• CI/CD provenance gaps — packages no longer published through trusted pipelines

Available as MCP server (no login required), CLI (npx proof-of-commitment), GitHub Action, and web UI at getcommit.dev.

Format

Follows the existing table format used in this section.