Acabo de crear un nuevo proyecto Nextjs + TS usando npx create-next-app@latest --ts (según la documentación).

Sigo recibiendo 3 vulnerabilidades de alta gravedad, npm audit fix --force, lo empeora al agregar alrededor de 24 vulnerabilidades de alta gravedad.

¿Alguna forma de evitar esto? ¿Debo preocuparme de haber instalado un paquete malicioso?

 # npm audit report node-fetch <2.6.7 Severity: high ---> node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor - https://github.com/advisories/GHSA-r683-j2x4-v87g <--- fix available via `npm audit fix --force` Will install next@10.0.1, which is a breaking change node_modules/node-fetch next 9.0.6-canary.0 - 9.3.4-canary.0 || 10.0.2-canary.0 - 12.0.8 Depends on vulnerable versions of node-fetch node_modules/next eslint-config-next >=10.2.1-canary.2 Depends on vulnerable versions of next node_modules/eslint-config-next

 firebasetest ├─┬ https://opencollective.com/eslint │ │ └── eslint@8.7.0 │ ├── https://github.com/sponsors/epoberezkin │ │ └── ajv@6.12.6 │ ├─┬ https://github.com/chalk/chalk?sponsor=1 │ │ │ └── chalk@4.1.2 │ │ └── https://github.com/chalk/ansi-styles?sponsor=1 │ │ └── ansi-styles@4.3.0 │ ├── https://github.com/sponsors/sindresorhus │ │ └── escape-string-regexp@4.0.0, globals@13.12.0, type-fest@0.20.2, import-fresh@3.3.0, strip-json-comments@3.1.1, globby@11.1.0 │ ├── https://github.com/sponsors/mysticatea │ │ └── eslint-utils@3.0.0, regexpp@3.2.0 │ └── https://github.com/sponsors/isaacs │ └── rimraf@3.0.2, glob@7.1.7 ├── https://opencollective.com/browserslist │ └── caniuse-lite@1.0.30001301, browserslist@4.19.1 ├── https://opencollective.com/postcss/ │ └── postcss@8.2.15 ├── https://github.com/chalk/supports-color?sponsor=1 │ └── supports-color@8.1.1 ├── https://github.com/sponsors/feross │ └── safe-buffer@5.2.1, run-parallel@1.2.0, queue-microtask@1.2.3 ├── https://opencollective.com/babel │ └── @babel/core@7.16.12 ├── https://opencollective.com/typescript-eslint │ └── @typescript-eslint/parser@5.10.1, @typescript-eslint/scope-manager@5.10.1, @typescript-eslint/visitor-keys@5.10.1, @typescript-eslint/types@5.10.1, @typescript-eslint/typescript-estree@5.10.1 ├── https://github.com/sponsors/ljharb │ └── resolve@2.0.0-next.3, array-includes@3.1.4, call-bind@1.0.2, es-abstract@1.19.1, es-to-primitive@1.2.1, is-date-object@1.0.5, has-tostringtag@1.0.0, is-symbol@1.0.4, get-symbol-description@1.0.0, has-symbols@1.0.2, is-callable@1.2.4, is-negative-zero@2.0.2, is-regex@1.1.4, is-shared-array-buffer@1.0.1, is-weakref@1.0.2, object-inspect@1.12.0, object.assign@4.1.2, string.prototype.trimend@1.0.4, string.prototype.trimstart@1.0.4, unbox-primitive@1.0.1, has-bigints@1.0.1, which-boxed-primitive@1.0.2, is-bigint@1.0.4, is-boolean-object@1.1.2, is-number-object@1.0.6, side-channel@1.0.4, get-intrinsic@1.1.1, is-string@1.0.7, array.prototype.flat@1.2.5, object.values@1.1.5, array.prototype.flatmap@1.2.5, object.fromentries@2.0.5, object.hasown@1.1.0, string.prototype.matchall@4.0.6, regexp.prototype.flags@1.4.1 └── https://opencollective.com/core-js └── core-js-pure@3.20.3