I've just created a new Nextjs + TS project using npx create-next-app@latest --ts (as per the documentation).

I keep receiving 3 high severity vulnerabilities, npm audit fix --force, makes it worse by adding around 24 high severity vulnerabilities.

Any way around this? should I be concerned that I might have installed a malicious package?

# npm audit report

node-fetch  <2.6.7
Severity: high
 ---> node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor - https://github.com/advisories/GHSA-r683-j2x4-v87g <---
fix available via `npm audit fix --force`
Will install next@10.0.1, which is a breaking change
node_modules/node-fetch
  next  9.0.6-canary.0 - 9.3.4-canary.0 || 10.0.2-canary.0 - 12.0.8
  Depends on vulnerable versions of node-fetch
  node_modules/next
    eslint-config-next  >=10.2.1-canary.2
    Depends on vulnerable versions of next
    node_modules/eslint-config-next

firebasetest
├─┬ https://opencollective.com/eslint
│ │ └── eslint@8.7.0
│ ├── https://github.com/sponsors/epoberezkin
│ │   └── ajv@6.12.6
│ ├─┬ https://github.com/chalk/chalk?sponsor=1
│ │ │ └── chalk@4.1.2
│ │ └── https://github.com/chalk/ansi-styles?sponsor=1
│ │     └── ansi-styles@4.3.0
│ ├── https://github.com/sponsors/sindresorhus
│ │   └── escape-string-regexp@4.0.0, globals@13.12.0, type-fest@0.20.2, import-fresh@3.3.0, strip-json-comments@3.1.1, globby@11.1.0
│ ├── https://github.com/sponsors/mysticatea
│ │   └── eslint-utils@3.0.0, regexpp@3.2.0
│ └── https://github.com/sponsors/isaacs
│     └── rimraf@3.0.2, glob@7.1.7
├── https://opencollective.com/browserslist
│   └── caniuse-lite@1.0.30001301, browserslist@4.19.1
├── https://opencollective.com/postcss/
│   └── postcss@8.2.15
├── https://github.com/chalk/supports-color?sponsor=1
│   └── supports-color@8.1.1
├── https://github.com/sponsors/feross
│   └── safe-buffer@5.2.1, run-parallel@1.2.0, queue-microtask@1.2.3
├── https://opencollective.com/babel
│   └── @babel/core@7.16.12
├── https://opencollective.com/typescript-eslint
│   └── @typescript-eslint/parser@5.10.1, @typescript-eslint/scope-manager@5.10.1, @typescript-eslint/visitor-keys@5.10.1, @typescript-eslint/types@5.10.1, @typescript-eslint/typescript-estree@5.10.1
├── https://github.com/sponsors/ljharb
│   └── resolve@2.0.0-next.3, array-includes@3.1.4, call-bind@1.0.2, es-abstract@1.19.1, es-to-primitive@1.2.1, is-date-object@1.0.5, has-tostringtag@1.0.0, is-symbol@1.0.4, get-symbol-description@1.0.0, has-symbols@1.0.2, is-callable@1.2.4, is-negative-zero@2.0.2, is-regex@1.1.4, is-shared-array-buffer@1.0.1, is-weakref@1.0.2, object-inspect@1.12.0, object.assign@4.1.2, string.prototype.trimend@1.0.4, string.prototype.trimstart@1.0.4, unbox-primitive@1.0.1, has-bigints@1.0.1, which-boxed-primitive@1.0.2, is-bigint@1.0.4, is-boolean-object@1.1.2, is-number-object@1.0.6, side-channel@1.0.4, get-intrinsic@1.1.1, is-string@1.0.7, array.prototype.flat@1.2.5, object.values@1.1.5, array.prototype.flatmap@1.2.5, object.fromentries@2.0.5, object.hasown@1.1.0, string.prototype.matchall@4.0.6, regexp.prototype.flags@1.4.1
└── https://opencollective.com/core-js
    └── core-js-pure@3.20.3