Why npm & pnpm audit miss vulnerabilities

A clean audit means one advisory source, reachable at one moment, found nothing in the view of your tree it was handed. Here is what that leaves out.