Report the vulnerability in the security advisory section of the repository.

If your submission is valid, a GitHub advisory will be published and if present in NPM or other released packages, a CVE will be requested.