When you send an email to security@npmjs.com, a "security point of contact, who will delegate incident response activities as appropriate." per their security d

When you send an email to security@npmjs.com, a "security point of contact, who will delegate incident response activities as appropriate." per their security documentation here: https://www.npmjs.com/policies/security https://www.npmjs.com/policies/security I'm assuming because this package has relatively low impact, it was given a triage rating of `P3` (also described on that documentation page). That means it is "Low severity, fix within 180 days".