Rather than rely on a single source of truth for audits, it seems to rely on developers specifying a location which is trusted to make audit reports about their modules.
That's a slightly different trust model, but it's better than nothing and at least prevents the controversial false positives problem of "npm audit":
Speaking of which, I was wondering if it has an equivalent for "npm audit", and I've found a project which provides some of that capability:
https://deno.land/x/[email protected]
Rather than rely on a single source of truth for audits, it seems to rely on developers specifying a location which is trusted to make audit reports about their modules.
That's a slightly different trust model, but it's better than nothing and at least prevents the controversial false positives problem of "npm audit":
https://news.ycombinator.com/item?id=27761334