Spotted this today. May be useful if have inherited a site with many packages: https://github.com/marketplace/actions/check-vulnerable-nuget-packages