On: Ask HN: How do you check for malware in OSS packages?

What tools have you been using to scan NPM/Python/Ruby/Go packages for malicious dependencies? How do I know if one of the dependencies in my package is not going to steal my NPM credentials, for example?