I work on this project, so I'm biased, for sure, but why not take a gander at: https://github.com/sonatype-nexus-community/auditjs https://github.com/sonatype-

I work on this project, so I'm biased, for sure, but why not take a gander at: https://github.com/sonatype-nexus-community/auditjs https://github.com/sonatype-nexus-community/auditjs By default we exclude devDeps (allowing you to run that later). The project functions off EXACTLY what you have installed in your node_modules, so it's a pretty accurate look at your actual risk profile. You can run it with --dev to get a look at your dev Deps, but we tailored it by default to your "prod risk profile". The notes y'all make are pretty much why. Every Dev Dep in the world seems to use lodash, so yeah, we get it, it can be prototype polluted, tell me what my actual risk is!