Ask HN: How do you keep track of node packages/ruby gems security issues?

For some reason vulnerabilities in node packages and ruby gems are not commonly assigned CVE IDs (pip packagea, for example, get CVEs and it's easy to follow).

How do you guys keep your packages secure? I am aware of the commercial services that solve this issue (snyk, nodesecurity) but I am looking for a free solution