This is both brilliant and frustrating. The brilliant part is much discussed here already, so... The frustration is that my projects, and I suspect the bulk of

This is both brilliant and frustrating. The brilliant part is much discussed here already, so... The frustration is that my projects, and I suspect the bulk of projects the get these alerts, get them because of transitive dependency. At least from my first look I did not see the transitive dependency path mentioned, so although I didn't need to know anything to read the alert, I had to dig through NPM features to figure it out. As the maintainer of "end-user" projects that depend on various big pieces of tooling, it turns out that I'm not really much of a position to do anything about the transitive dependencies anyway, other than manually track down the dependency path and then go open issues in each thing along the way. Something like the following seems like it would help focus attention toward the points where things have to be fixed: a kind of leaderboard, a (gentle and friendly) "wall of shame". Projects would earn their way to the top of this wall by depending on vulnerable things themselves, and then being depended on by other projects directly or indirectly.