Yeah I am thinking more something like linting+ for packages. And for published code, not code from the git repo.

    % analyze-some-npm-package some-package@2.1.1
    → some-package/foo.js contains a syntax error
    → some-package/bar.js calls eval() on line blah blah
    → sub-dependency@2.3.4 is only 2 hours old

...that sort of thing. I suppose it would be a pretty big undertaking.