npm-audit-alternative

npm audit isn't enough: what it misses

npm audit catches known CVEs and stops there. It misses malicious packages, install scripts, and typosquats -- the threats actually landing in npm today.