Security: transitive vulnerabilities in extract-zip and elliptic (no npm fix available)

Summary

npm audit on a downstream Next.js project reports vulnerabilities in transitive dependencies of @hexclave/cli and @hexclave/shared / @hexclave/next. No patched versions are available on npm for either library.

Project: aidvocate Versions: @hexclave/next ^1.0.108, @hexclave/cli ^1.0.108

Findings

1. extract-zip (HIGH) — dev dependency via @hexclave/cli

• Advisory: GHSA-jmr9-qjv8-65gv
• Package: [email protected] (latest; advisory range <=2.0.1)
• CVSS: 8.1 — unvalidated symlink path traversal
• Scope: Dev-only (@hexclave/cli); not shipped to production builds

2. elliptic (LOW) — production dependency via @hexclave/shared

• Advisory: GHSA-848j-6mx2-7j84
• Package: [email protected] (latest; advisory range <=6.6.1)
• CVSS: 5.6 — risky cryptographic primitive implementation
• Scope: Production runtime via @hexclave/next → @hexclave/shared

npm audit output

8 vulnerabilities (6 low, 2 high)
npm audit fix: no fix available

Production-only audit (npm audit --omit=dev): 4 low, 0 high.

Questions

1. Is Hexclave aware of these advisories, and is there a remediation timeline?
2. For extract-zip: would Hexclave consider replacing it (e.g. with tar, which @hexclave/cli already depends on)?
3. For elliptic: is migration to @noble/curves or Node crypto planned?

Contact

Opened from the aidvocate project. Happy to provide full npm audit --json output if helpful.