I'll add that you get these vulnerability reports whenever you install a new module into a node project, though the example here is extreme.