Please don't open a public issue for a security problem. Report it privately through GitHub instead: on this repository's Security tab, choose Report a vulnerability (direct link).

Include the package and version (or commit) affected, what an attacker could do, and steps to reproduce it if you have them.

No package has been published to npm yet, so fixes land on main. Once the packages are published, only the latest published version of each receives security fixes.