Regular Expression Denial of Service

[vytenis-nfq]

[rousan]

The package babel-cli(popular one) causes that, not npmf.

[vytenis-nfq]

But you are requiring that vulnerable version "babel-cli": "^6.26.0",
Or use npm-lock.json file and fix that deep dependency by running npm audit fix --force