self-taught SE, working over 20 years in the industry. No CS degree.

4. love for technology, everything else was a side effect. To this day it still feels magical with many layers to uncover and learn.

I was also a bit confused and expected something like grype -https://github.com/anchore/grype

I was also expected something like this, but I didn't know for grype till now. Thanks! Is there anything similar to this for npm packages?

I built Packj https://github.com/ossillate-inc/packj to scan NPM/PyPI/Ruby packages for CVEs and malicious/risky attributes.

I do software development for living and do not have any special backups for dev related files other than git. For general office documents I use Seafile (selfhosted Dropbox equivalent) and have redundant copies of important files on multiple machines and the central Seafile server. If I need real backups with the ability to restore a set of files in a specific point in time I use restic.