[ermir]

What would really integrate with the developer workflow would be some kind of npm command that can check the package.json or the lock file and generate instant output on the console. You can then have whitelists, integration with CI/CD, and lots of other neat stuff.

[feross]

We have that too :)

https://docs.socket.dev/docs/socket-cli