socket.dev will find most malware within hours of it being published.

with LavaMoat most malware won't work even if you don't detect it.