Basically you do this:
Provides: bundled(bootstrap) = 3.0.1
This way it is possible to search the collection of RPMs for all that
contain versions of dependencies with known security issues.

That's neat, I could write a script that extracts the versions from the npm-shrinkwrap file.
However, at the moment there are 1137 of them. It might be a bit unpractical to read the specfile after the cut-n-paste.
Welcome to NodeJS :-P
(or should I try to write an RPM macro? maybe)

Aurélien