Do you want to try out drydock.org? It will show you the diff of the staged package and send you an email when it's done all threat controls
Drydock: pre-publish package review
Drydock lets npm, PyPI, and VS Code maintainers review the exact package artifact before an npm stage publish or gated release goes live.
drydock.org