Report a security vulnerability directly to the maintainers by sending an email to [email protected] or by reporting a vulnerability to the NPM and Github security teams.