GitHub has done exactly that for several years: https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts https://docs.githu

GitHub has done exactly that for several years: https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts https://docs.github.com/en/code-security/dependabot/dependab... However, that approach will only find vulnerable dependencies in Git repositories, not ones that exist in already-published binary artifacts.