GHSA-w7h5-55jg-cq2f

### Impact This is a **remote code execution (RCE) vulnerability**. Node.js automatically imports `**/*.plugin.{js,mjs}` files including those from `node_modules`, so any malicious package with a `.plugin.js` file could execute arbitrary code when installed or required. **All projects using this loading behavior are affected**, especially those installing untrusted packages.

### Patches The issue has been **patched in v0.0.5**. Users should upgrade to **v0.0.5 or later** to mitigate the vulnerability.

### Workarounds - Audit and restrict which packages are installed in `node_modules`.

### References - [CWE-94: Improper Control of Generation of Code](https://cwe.mitre.org/data/definitions/94.html) - GitHub Security Advisories documentation: [https://docs.github.com/en/code-security/security-advisories](https://docs.github.com/en/code-security/security-advisories)