I am working on npm supply-chain security. My tool is called @lateos/npm-scanner You can install it via npm -I @lateos/npm-scanner . The npm readme page is at https://www.npmjs.com/package/@lateos/npm-scan and open spruce is at https://github.com/lateos-ai/npm-scan . I appreciate all input and feedback