Would be great to run their tool as a proxy to npm whenever you install rather being triggered on a github action.