I agree. There are projects such as https://github.com/ossf/package-analysis https://github.com/ossf/package-analysis and https://github.com/step-security/harde

I agree. There are projects such as https://github.com/ossf/package-analysis https://github.com/ossf/package-analysis and https://github.com/step-security/harden-runner https://github.com/step-security/harden-runner that do behavior analysis. Disclosure: I’m maintainer of the second one.