Hacker News Reader

That assumes someone is actually auditing the npm deps.

It’s trivial to audit your dependencies with https://socket.dev

Disclosure: I’m the founder.

Despite the ease of auditing services, there are notoriously a lot of devs using unaudited deps. Maybe they don't even think about it, unfortunately.