Even worse, the CVE is effectively “if you use the package wrong, you get weird results”.
The affected method has signature function isPrivate(ip: string): boolean
. Passing in a hex number is not a string, and a method (toString
) exists for this.
Because they’re using events and downloading a few megabytes of extra javascript framework is, of course, a way better option than six lines of SVG stylesheets.
Edit: forgot a /s