For packages with malicious or compromised releases only. CVEs and code vulnerabilities belong on OSV or Snyk.