I saw a recorded conference talk where they mentioned Snyk as a way to keep your eye on package vulns, but have never used it myself