This is exactly what we provide at Socket. See https://socket.dev

We flag anything a package introduces new install scripts, network, etc.