> if there are any packages that are being pulled in that are frequent security concerns. As an individual, do you think you can do that? I know a lot of pac

> if there are any packages that are being pulled in that are frequent security concerns. As an individual, do you think you can do that? I know a lot of packages with security concerns where CVEs are never issued. You just need to go to their PRs and luck into finding descriptions of a security fix. I doubt this would scale for a given individual.