NPM cli uses a version of glob which has https://nvd.nist.gov/vuln/detail/CVE-2025-64756. This is patched in glob 10.5.0 and 11.1.0.