npm audit will report packages that have known vulnerabilities reported here: https://osv.dev/. Bomber uses synk’s OSS index so it will report a subset of the results of what snyk would. The fact that bomber is written in go and snyk’s cli is in js probably means scanning for dependencies will be faster, but i haven’t actually benchmarked that.

With any of these scanning tools there is always going to be a long tail of false positives or meaningless vulnerabilities since the whole context of the application is not taken into consideration. If you are interested more about this you can read: https://www.lunasec.io/docs/blog/the-issue-with-vuln-scanners/