How do senior engineers prioritize which npm package vulnerabilities to fix first when the security scanner reports dozens of warnings?