Fix a critical NPM package vulnerability