I've created a small package-lock.json analyzer to ensure you have no supply-chain issues