Check out https://socket.dev/
Been super impressed by their approach to identifying and securing codebases against supply chain attacks (and I believe they have a special deal for open source repos too!)
I wonder how this compares to Snyk, also in the area of securing against supply chain attacks.