Yep. I feel the same pain with `debug` on npm and have almost given up on the project entirely. A few security "researchers" determined that since the code coul

Yep. I feel the same pain with `debug` on npm and have almost given up on the project entirely. A few security "researchers" determined that since the code could technically be executed by an application connected to the network that thus a regular expression complexity issue must also have a network vector of attack, which immediately boosts the score up by a LOT and... ... increases their payout on bug bounty sites. :) Because of course it does. Snyk, Huntr, and VulDB, I'm looking at you. CVEs mean nothing to me anymore. The entire system is beyond fucked.