node-gyp

The npm audit that works because it never installs the package

A dev.to walkthrough puts metadata and tarball inspection first, on the grounds that most npm malware fires during install and not at import. It needs nothing you have to buy.