Add proof-of-commitment supply chain hook to Community Resources

[piiiico]

Adds the proof-of-commitment supply chain hook to Community Resources.

What it does: poc hook --windsurf installs a pre_run_command hook that intercepts package installs (npm install, pip install, cargo add, go get) and checks them against behavioral supply chain risk signals before execution. CRITICAL packages (single publisher + high download volume — the exact attack profile used in the axios and LiteLLM compromises) are blocked.

Why it matters for Windsurf users: The Shai-Hulud worm (May 2026) specifically targeted AI coding assistants, planting persistence hooks in IDE config files. When an AI agent installs dependencies autonomously, this hook is the gate that catches compromised packages.

Install: npx proof-of-commitment hook --windsurf (one command, writes .windsurf/hooks.json).

Note

Add proof-of-commitment supply chain hook to Community Resources in README

Adds a new entry under the Community Resources section of README.md linking to a proof-of-commitment supply chain hook for the Windsurf IDE, with a brief description of the commands it intercepts.

^{Macroscope summarized b978d83.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Documentation-only change adding an external link, but the author does not own README.md. The designated code owner should review this community resource addition, especially since it links to the author's own project.

^{You can customize Macroscope's approvability policy. Learn more.}