You can host your own NPM reg, and examine every package, but your manager probably is NOT going to go for that.