Several popular npm packages transitively have this problem, including a recent popular one. It's only a matter of time before someone takes advantage of this.

2 likes 1 replies