
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
@powforge/comment-witness
Advanced tools
DoI-weighted comment credibility scoring. A comment from one long-tenured human outweighs 500 sock-puppet replies. Same NIP-33 + DoI pattern as @powforge/vote and @powforge/news-witness, applied to discussion threads. Sybil-resistant comment ranking with
DoI-weighted comment credibility scoring. A comment from one long-tenured human, vouched by three more, outranks one flooded by 500 fresh sock-puppets. Sybil-resistant comment ranking with no central registry.
Same DoI pattern as @powforge/vote
(proposals) and @powforge/news-witness
(stories), applied to discussion threads. The pattern is now canonical.
npm install @powforge/comment-witness
const {
submitComment,
vouchComment,
getCommentCredibility,
getTopComments,
} = require('@powforge/comment-witness');
const { commentId } = submitComment(
'This is the alpha take on PowForge.',
authorPubkey, // 64-char hex Nostr pubkey
'https://news.ycombinator.com/item?id=12345',
);
vouchComment(commentId, voucherPubkey);
const cred = await getCommentCredibility(commentId);
console.log(cred.weightedScore, cred.doiBreakdown);
const top = await getTopComments(
'https://news.ycombinator.com/item?id=12345',
10,
);
Reddit ranks by upvotes. HN ranks by upvotes. Twitter ranks by hearts. Every count-based ranking surface is gameable by one operator with 500 fresh accounts. Centralized identity gating (Reddit karma minimums, HN account-age throttles, blue checks) tightens the gate slightly and leaks who you are.
@powforge/comment-witness makes the credibility weight of a comment
AND each vouch on it a function of the author's
Depth-of-Identity score — accumulated
irreversible work across social, access, vouch, and economic dimensions.
A 500-account farm contributes ~500 × ~0 weight; one long-tenured human
contributes one × ~50.
submitComment(content, pubkey, topic, parentId?) accepts an optional
parentId to thread replies. By default getTopComments ranks only
top-level comments; pass { includeReplies: true } to rank the whole
tree. getReplies(parentId, { recursive }) walks descendants.
An author vouching their own comment contributes doiWeight=0 to the
weighted score (same rule as @powforge/vote). Raw weight is still
surfaced in doiBreakdown.vouches[].weight for inspection.
Pass { scoreFn } to getCommentCredibility or getTopComments to
inject a deterministic mock or a non-default DoI source:
const scoreFn = async (pubkey) => ({ weight: customWeights[pubkey] || 0 });
await getCommentCredibility(commentId, { scoreFn });
The default scoreFn lazy-loads @powforge/identity, so the SDK is only
required when you actually use the production scoring path.
MIT
FAQs
DoI-weighted comment credibility scoring. A comment from one long-tenured human outweighs 500 sock-puppet replies. Same NIP-33 + DoI pattern as @powforge/vote and @powforge/news-witness, applied to discussion threads. Sybil-resistant comment ranking with
The npm package @powforge/comment-witness receives a total of 4 weekly downloads. As such, @powforge/comment-witness popularity was classified as not popular.
We found that @powforge/comment-witness demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.