>> Isn't the fact that it's built on top of JavaScript kind of throw the idea of security out the window to start with

No.

>> Shouldn't we start with JavaScript security advisories

Its a language, not a specific implementation of a language. Chromes javascript engine is what would have security vulnerabilities, no javascript itself.

This isn't security advisories for node itself, it is for node modules. the node security project is auditing all of the modules in npm for security issues, and posting about them there.