How to prevent use risky npm packages which scanned by osv-scanner in bun?

[dlintw]

For example, osv-scanner scan gitea's package-lock.json.

1. bun's lock file can not be scan by osv-scanner(maybe require someone to patch that).
2. Any option of bun can be enable to prevent using those risky package?
3. How to solve those risky package if they exists in deep dependency. Can I manually solve those in bun's env when the upstream already dead or I require fix them ASAP?