Give it a public URL. It reads the JavaScript the app ships and tells you which npm packages are vulnerable.
For sites you own or run. 3 free audits as a guest, no account. Sign in for 10 free audits, schedules and email reports.