NPM audit is largely useless[0]. Most people don’t care that the CSS minifier can cause an out-of-memory when fed a bad class name, because that step happens during the build process and not with untrusted code. There isn’t a way to isolate only issues that can be exploited in the production code.