legacy-javascript package is connected to CVE-2020-7645

Hey folks, our security scanners caught this thingy. I see that there is no way to get rid of this issue, because no safe package is available.

Do you plan to look into it?

Thanks!