I think <a href="https:&#x2F;&#x2F;nodesecurity.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;nodesecurity.io&#x2F;</a> will help you.<p>Security flagging that can parse your dependency tree is a good solution to this in my opinion.