For what I do in my day-to-day, security vulnerabilities are reported by `npm` automatically when updating packages and there are several pieces of nice tooling around identifying the versions that exhibit the vulnerability and getting around them.

I think the `npm` community is going in the right direction and learning from mistakes of the past on this topic.