[enumjorge]

The problem is, if a security vulnerability snaked past the maintainers of a project, what hope do I have as someone who consumes the package to a) catch it b) know how to fix it?

[cphoover]

That's exactly the issue that npm-audit seeks to ameliorate. It's not perfect, but it's better than nothing.