we made a tool that automates that process - https://trustd.dev https://trustd.dev it will analyse open-source packages as you install them and tell you of any

we made a tool that automates that process - https://trustd.dev https://trustd.dev it will analyse open-source packages as you install them and tell you of any vulnerabilities before they are even on your system... meaning it will detect problems in the libraries you aren't thinking about.