Report vulnerabilities privately via GitHub's built-in advisory tool:
https://github.com/arach/hudson/security/advisories/new
Do not open a public issue for security reports.
The latest published npm versions and main are supported. Older releases are
not patched.