Comparison with npm outdated about npmvet HOT 1 OPEN

One very valuable thing is the -ci option, which returns a failure if there is a mismatch between the currently installed node modules and expected/wanted version in package.json.

Not everyone has CI set up for fresher projects, and ensuring the app cannot run locally for development or be published if expected/wanted package versions are not met is not only useful for new developers getting a reproducible build (Pinning versions with == and package-lock.json already ensure this), but for developers who haven't worked on the project for some time, and who have no idea they need to update their packages to the latest version in package.json if they are still able to run the project and don't see any immediate issues.

from npmvet.