I don't think building custom solutions will give the best ROI in the long run. In JS ecosystem, I rely on npm vulnerability warnings to figure out if something is broken.