Implement "composer audit" for NPM packages

[prudloff-insite]

It would be useful if composer audit could work for npm-asset/ packages.
composer audit reads a security-advisories key in the JSON returned by the repository.
Some other third-party Composer repositories have already implemented it (for example: https://repo.packagist.org/p2/drupal/core.json).
It should be possible to call the the NPM audit API (https://registry.npmjs.org/-/npm/v1/security/audits) and convert the result to the Composer format when building the Composer repository.

(I created a Composer plugin that does this but as a separate command: https://github.com/prudloff-insite/composer-npm-audit)

[SilverFire]

Hello.
Thank you for your idea!
We don't have enough resources to implement this enhancement right away, but this repo is tagged with the hacktoberfest tag, so maybe someone would like to push this idea to the implementation.