There's a Regular Expression Denial of Service vulnerability in the ansi-regex package in versions < 6.0.1: #41