[riyakhanna1983]

Snyk only checks for known vulnerabilities, not if the package itself is malicious.