[cphoover]

That's exactly the issue that npm-audit seeks to ameliorate. It's not perfect, but it's better than nothing.