We do exactly that at Depfu (for Ruby): https://depfu.com/blog/2017/09/28/depfu-now-flags-security-u...

But I'm also pretty sure Github is going to do that soon, it's an obvious next step.