## Audit Standards
- Packages with no release in >12 months: flag as stale
- Single-maintainer packages: flag as bus-factor risk
- Any unpatched CVE: flag as security risk
- GPL in MIT project: flag as license incompatibility
- Compromised packages: flag as CRITICAL
