But this wouldn’t catch issues with pushing immediately after being granted access, new github accounts pushing changes to libs with thousands of dependents, libs whose dependencies were yanked from npm. Only published vulnerabilities, right?
My apologies, I assumed you meant ones with known vulnerabilities. Given OP's link that was a bad assumption to make.