it could also be run automatically when cd-ing into a directory by overriding the default cd

    cd() {
      builtin cd $*
      if [ -f "package.json" ] ; then
        npm check-vulnerabilities
      fi
    }

I reckon you could also use this with david[0] to check if packages are up to date.

[0] https://github.com/alanshaw/david