Dependency audit
Also called npm audit
Checking the versions you have installed against a public list of known vulnerabilities. npm audit is one such command. It can only find what has already been reported.
It costs nothing and catches old, known problems. But it can be noisy, flagging code you never call, and it won't notice a brand-new malicious package at all. An agent told to make it clean may do something worse to get there.
Say it to your agent
“Run npm audit --audit-level=high in CI. Don't use --force. For each high finding, tell me whether our code reaches the vulnerable function, what the upgrade changes, and which tests prove it still works.”