Vulnerability issue while running npm audit under test:security:npm

[abhisheksbhokare]

Project environment details :
Node : 20.19.2
NPM : 11.1.4
React : 18.2.0
React-multi-carousel : 2.8.6
brace-expansion : 2.0.1

Description:
In my project we are using 'react-multi-carousel (v2.8.6)' package which is indirectly dependent on 'brace-expansion (v2.0.0)' package. recently new version of 'brace-expansion (v2.0.1)' was launched which is not compatible with current version of 'react-multi-carousel' which is causing for CICD pipeline failure. ( I was working well with v2.0.0 of brace-expansion )

npm audit report

brace-expansion 2.0.0 - 2.0.1
brace-expansion Regular Expression Denial of Service vulnerability - GHSA-v6h2-p8h4-qcjw
fix available via npm audit fix
node_modules/npm/node_modules/brace-expansion

1 low severity vulnerability

After running npm audit fix showing below warnings :

npm audit fix
npm warn audit fix brace-expansion@2.0.1 node_modules/npm/node_modules/brace-expansion
npm warn audit fix brace-expansion@2.0.1 is a bundled dependency of
npm warn audit fix brace-expansion@2.0.1 npm@10.9.2 at node_modules/npm
npm warn audit fix brace-expansion@2.0.1 It cannot be fixed automatically.
npm warn audit fix brace-expansion@2.0.1 Check for updates to the npm package.

Upgraded npm to a latest version that includes brace-expansion ≥ 2.0.2, but no luck!

Need you support in order to resolve this issue, Thank you.

[halovanic]

I also came across this result as well going back to vulnerability or license complaints scanning the npm dependency. I think this ultimately traces back to the fact that react-multi-carousel lists out npm, install and core-js as direct dependencies, when there doesn't seem any reason for the built package to pull those in.

I have not been able to dig into the build process to understand why the output package does that, but it did change between 2.8.5 which listed no dependencies and 2.8.6 which added these:
https://www.npmjs.com/package/react-multi-carousel/v/2.8.5?activeTab=dependencies
https://www.npmjs.com/package/react-multi-carousel/v/2.8.6?activeTab=dependencies

So downgrading to 2.8.5 might "solve" these scans temporarily.

[mich-zang-scacap]

Sounds like the classic issue of pasting npm install core-js into the command line when you already prepared npm install beforehand leading to npm install npm install core-js