npm audit reports known vulnerabilities, but I think it doesn't help against supply chain attacks, or does it?