What tools have you been using to scan NPM/Python/Ruby/Go packages for malicious dependencies? How do I know if one of the dependencies in my package is not goi

What tools have you been using to scan NPM/Python/Ruby/Go packages for malicious dependencies? How do I know if one of the dependencies in my package is not going to steal my NPM credentials, for example?