I have a problem where I have too many vulnerabilities on a few hundred repositories introduced with outdated npm packages. The issue is that I need to find a way to prioritize this. The biggest pain in the butt for me is that the engineering team wants proof of vulnerability exploitation so that they patch the package.
Is there any tool that could be used to check if a vulnerable package actually poses a threat to the app? I know Snyk has --reachable but it is used only for Java projects, and I need something for nodejs.