Please don't report security problems in public issues or pull requests.
Report them privately through GitHub instead: open the Security tab of this repository and choose Report a vulnerability, or go straight to https://github.com/bitfocusas/api/security/advisories/new. Bitfocus maintains this package and will follow up there.
Security fixes go into the latest release on npm only.