Comment by OJFord

If you're going to audit your dependencies sufficiently to know that then you don't need a tool like this anyway?